Does Anti-Virus make a difference?

Like so many of us in the profession, I was asked to look at friend’s computer. Nothing specific was wrong; she had just moved out of an “Friend/Ex-Friend’s” house. She was worried that they might have done something to her machine. So I started looking at it. Nothing looked really out of place. The owner would never install anything (including updates or e-mail links). So after updating everything, I started to scan for viruses and malware. That’s when I noticed that there was no anti-virus software. I thought that was odd because there was the update program. I asked if she had uninstalled it and she said, “no.” It then hit me:  the “evil plan” was to remove her anti-virus and trouble would soon follow.  Fortunately, her “safe-surfing” habits of never opening or installing programs had saved her! Even after 3 months of surfing, she still had a clean machine. I guess this is pretty good evidence that “Safe-Surfing” and a little luck can keep you safe.

Advertisement

A friend sent me this about E-mail Security

The true state of security 🙂

So a friend sent this to me awhile ago. I figured it would be great for the New Year

They say a picture is worth a thousand words.

A non-deceptive SE event

Ok, So listening to the latest Social Engineer Podcast   http://www.social-engineer.org  I realized I needed/forgot to write in about a non-deceptive SE event.

 I had won some license plate holders at Ohio Linuxfest a many years ago. So I went to put them on and the screw broke. I went to a local dealer asked if they could put them on. They, like all good dealers said “Sure! $30 each plate.” $60 total is a lot so I started thinking. I ask the manger if he was really going to charge me $60 to remove the advertizing of a competitor? His answer was “Would you like a car wash with this complimentary service?”

The data they collected is at http://www.social-engineer.org/polls/social-engineering-and-deception-whats-the-truth/

A Reply from @Ubertwiter

If your on Twitter and use Ubertwiter then you may have seen this post:

RT @secureideas: RT @Jhaddix: Watching Ubertwitter steal yr data, @Ubertwitter – the uber-spy: http://bit.ly/cN2zke

http://blog.infobytesec.com/2010/07/ubertwitter-your-secret-spy.html

So I contacted them and here is their reply:

From: UberTwitter [mailto:ubertwitter@ubertwitter.com]
Sent: Tuesday, July 20, 2010 8:54 AM
To: David
Subject: Re: Feedback from @securid

 Hi David,

We collect this info for two reasons, first the PIN is used for subscription services, i.e. to turn off advertisements.   The lat/long is use to improved our location service and is covered in our terms & conditions.  Email is never filled out, and we will be removing phone number as there is no reason to have that.  Thank you for pointing this out.
-Paul
follow @ubertwiter for updates

A very nice and fast response. Remember some companies want to do the right thing, we just have to ask.

Thanks

Dave

Why Phish? Just invite!

Garage Sale on Craigslist

 

So I love garage sales as much or maybe more than the next person but this scares me. “We’ll be taking cash or Paypal. (To use Paypal you have to pay on site using my laptop and the transaction would have to clear before you leave. This means no E-check transactions.)” I don’t think the person is planning anything bad but, what if their computer is infected? Now everyone’s usernames and passwords have been exposed. Or what if an evil garage sale shopper has a USB Hacksaw with them and infects the computer? 

I have to run grarge sales are waiting…. 

http://cleveland.craigslist.org/gms/1764370329.html

Your phone been stolen lately?

So my friend works at a school. She was helping a student at her desk for about 15 minutes when the phone rang. She asked the student to hang on while she grabbed the phone. After a quick question she turned around to help the student again but, he was gone. A few minutes later she realized her phone was missing. So after trying to call it and checking the car again she had it turned off. So now that her 3+ year old phone was gone she went to get a new one. She got a Blackberry Curve. So jump forward in time to the next phone bill. She noticed some odd charges on the bill. Thirteen (13) V-Cast charges for music downloads. So she called up Verizon to ask about the charges. They said “The downloads where Hip-Hop, JZ.” Not my friends normal music and not sure if she knew how to download music to that phone. They removed the charges and apologized for the inconvenience.

In under an hour someone was able to steal thirteen (13) songs. Talk about a new reason to steal a phone. So talking to another friend about this he said that one of his Co-Workers had their phone stolen and didn’t cancel the service for about day and they downloaded over two hundred (200+) songs. It will be interesting to see if this was a onetime thing or the start of a trend. I haven’t heard mainstream media talk about it yet…

TSA swap’s laptop

So the other day a friend of a friend brought my friend Bob at Laptop and a great story. He was on his way home to Cleveland from out of the country. TSA did the standard search and seizure of all his belongings and he moved along. A little while later he went to log into his laptop and notice it wasn’t his. He had a non qwerty keyboard on his and this was a qwerty system. So he went to TSA and they were not much help. In fact they wanted him to give them the laptop. He said “NO” and kept the laptop. He wanted to have something to trade with the guy who had his laptop. TSA claimed to remember checking a guy with the name that was the same as the login name but, they couldn’t help him. The airlines were not much help either. So for about 3 days he kept calling the TSA and no respond.

So he brought the laptop to Bob. Bob called the computer manufacturer and explained the issue. Then he escalated the issue to a supervisor. The supervisor said sorry no subpoena no info. He did suggest Bob talk to the corporate offices and gave him the phone number. So Bob called. They were not much help either. So when they transferred him to the product registration group the time had come to stop playing games. Or was time to start? “Hi, This is Bob. I’d like to check that my co-worker has registered his laptop correctly.” So Bob quickly learned that the machine hadn’t been registered.  So they wanted a subpoena to say they had no info. Got to love it.

A few hours later the friend finally received a call from the TSA. They said “Sorry we haven’t heard anything yet. If you can Hack into the machine and get any info go for it.”  So Bob did. The ophcrack disks didn’t work(Laptop Froze.) So he went old school and ran an Ubuntu liveCD. Mounted the local drive and was in.

Then the fun of finding the owner started. Bob noticed a resume, resignation file and a job description. So the assumption is that maybe it’s a manager and an employee is leaving. Bob also noticed the pictures and movies on the drive didn’t feel like a typical set of guy pictures. He went back and looked at the resume again and then it all made sense. The resume was for a lady. Her e-mail address that was on the resume was very similar to the login ID of the laptop. Bob found the owner.

The laptops got swapped back to the correct owners and everyone is happy except for the TSA.

My BlackBerry Storm Review

Well I’ve had my Blackberry Storm for a few weeks now and I have a few tips to make it work better. I said “Better.”

1. Install the Blackberry Update that they released about a week after they started selling the Storm. This makes the phone act more like a Beta version.

2. Under the Options menu, Keyboard/screen set the font size to 10. This increases the size of the menus and other buttons. So if you have big hands/paws like me it’s easier to select the button you really want.

3. Remove the Blackberry Messenger. You need to uninstall it. This is one of the apps that Blackberry always keeps open for you so you have faster access to it. 

4. Close the apps your not using. A real pain, I know.

5. Don’t forget about rebooting the unit every now and then. I mean pull the battery for a good minute.

So even with these changes I still get it to crash and burn. (Just use the camera, video and playback.)

BlackBerry Storm Crashed again, and again.

Physical Security in MDF,IDF, and Phone rooms

Physical Security in MDF,IDF, and Phone rooms

All the companies that I’ve worked for have had the policy of “Never leave unauthorized people alone in the MDF’s, IDF’s , and the phone room’s. “ That being said, over the past year or so I’ve been talking to Phone Guy’s/Gal’s and such that have come to do work in these “sensitive areas.”

I asked them “How many companies require someone be with them? The answer is about half. That doesn’t seem very good. So then I start asking about the people that hang out with them. It seems that again only about half are computer and/or phone people. It seems odd that you would put a guard on the worker that doesn’t know anything about phones and computers.

Stupidity in strange places

I just took my car in for repair at the dealer for some warranty work. My dealership does a lot of on-line stuff. They even have an open wireless network and workstations to use while waiting for car work to be done. So I received the following E-mail from them:

Customer No. #######
Your vehicle is complete and ready for pick up. Please look over the
attached invoice and call with any questions. If the invoice is correct,
you can reply with a credit card number and expiration date. I will run
the credit card number to help speed up the delivery process.
Thank You for Your Business. Jane Doe ###-###-#### ext ###

The biggest issue is the word “Reply” there is no link in the E-mail to go to a secure payment page. Have you ever looked over a dealership invoice? There is a lot of personal information on it about you and your car.

So I went to the dealership and talked to the manager. I was very happy that he listened to me and sent out some e-mails. The first was to stop using above text on invoices. The second was to ask his internal people if I was correct and what is PCI. Does anyone know if this would break PCI compliance?