Latest on Technology, Systems, and Security
 
February 4th, 2010
 

Internet Explorer 6 is a web browser which first appeared in 2001. Since then, we’ve seen browsers like Mozilla Firefox, Apple Safari and Google Chrome establish themselves as serious choices alongside older alternatives like Opera. We’ve even seen IE7 and IE8 arrive on the scene.

All of these browsers leave IE6 in the dust in terms of security, reliability, compatibility and new features. Web developers have been tearing their hair out for years over the problems that IE6 and IE7 present when designing websites, while security firms have warned against using the outdated technology. Recent events have seen Google blame a vulnerability in IE6 for the China e-mail hacking fiasco and both the German and French governments recommend that citizens do not use Internet Explorer until the issues are fixed.

I firmly believe IE6 should be discontinued by Microsoft, along with IE7, leaving IE8 as their only supported browser on the market. What this would do would be to focus all their energies on their latest and greatest, enable developers the world over to cater to more modern browsers and help safeguard users’ private data.

I wouldn’t hold out much hope though. After all, Microsoft say IE6 will be supported until 2014, when it will be 13 years old. Brilliant.

 
January 31st, 2010
 

The latest phishing scam, focussing on the approaching tax return deadline has apparently been sent out to tens of thousands of prospective victims.

Scammers are getting increasingly clever about the methods they use to try and get users to visit a page and enter in their cred card details. Unsuspecting victims enter the site believing it to be a genuine tex return site, where they end up entering their credit card details, address, phone number and a whole host of other information.

Revenue and Customs has warned people not to respond to the emails being sent around as it only informs users of a refung by post.

 
January 18th, 2010
 

No big surprise here but the recent increase in the smart phone market has triggered hackers and cybercriminals to dust off some old tricks to try and install diallers and other exploits on smart phones.

People that fall into the traps of installing applications on smartphones end up with software that dials out to premium rate phone lines. Leaving the victim of such attacks with enormous phone bills and little or no way of retrieving a refund.

The diallers are mainly found on mobile porn sites, so if you are into that kind of thing, be careful and don’t download anything unless you are absolutely sure it’s safe to do so.

Google might well be pulling out of China this week after news that they were subjected to a sophisticated synchronised attack.

Google and other security experts have indicated that the attacks are from China itself (ie the PRC) and are much more advanced than the normal attacks received by normal isolated hackers.

The attacks targeted Chinese human rights activists worldwide and it’s fairly obvious from people in the know that the hackers were backed by a nation state.

It’s unfortunate that the Chinese government continues it’s efforts to isolate itself from the rest of the world. One thing is for sure: the PRC isn’t making itself any friends globally.

 
January 12th, 2010
 

In what looks like another DNS hack, China’s biggest search engine “Baidu” has been hacked.. Users who visit the site were redirected to another political message.

In a way it’s a bit of a relief that the hackers didn’t use the opportunity to launch a massive phishing scam.. literally millions of people’s data would have been compromised if this was the case, making it one of the biggest hacks ever.

It’s not immediately clear how the “Cyber Army” (probably a fat guy in his mums basement) got access to the dns records, but I’m quite sure there are a few hundreds of people looking into it.

 
January 7th, 2010
 

A new world record has been set where Pi (3.1415..) has been calculated to 2.7 Trillion digits. Whats perhaps more interesting is that it was completed by a simple desktop computer. This kind of thing is usually taken up by a supercomputer specially designed for crunching vast amounts of data.

If a simple desktop computer can work this out imagine how complex encryption need to be nowadays in order to keep one step ahead of would be attackers. With so much processing power at your disposal it’s becoming increasingly plausible for someone to crack higher levels of encryption.

Admittedly it was a pretty decent one with an i7 running at 2.93Ghz and 6GB of RAM. It also used up 1.5 Terabytes of data just on the number itself.

The number of computer users being trapped by dodgy security software is increasing, according to a recent study by security firm Symantec. Usually this fake software is advertised using banner adverts telling users that their system is infected with a virus or needs a security scan. But once the user clicks on the advert they are taken to the scammers’ website, where they will be pressured into buying the software on offer.

Once installed, the fake anti-viruses typically install other viruses and malware which is then used to steal confidential information such as bank and credit card details. Another facet of this is that the software will also try to suppress any other security software currently installed on the system, opening the floodgates for more malware to find it’s way onto the system.

The problem with this scam is that even if the user manages to safeguard their data, they have still lost out by paying for the software in the first place. This software does nothing of any use, and the money will end up with criminal gangs who make millions a year from the scheme. Fake review sites are also helping the criminals by giving a falsely positive view of the software they are trying to hawk to their unwitting victims.

Symantec is warning that up to 40 million people may have fallen foul of this scam in the last 12 months alone, a sign that things are not improving at all. The company is warning users to be ever more vigilant and to only trust known brands when buying anti-viruses and other similar applications. However, with more and more novice computer users going online all the time, and for longer periods, the chances of them being caught out are increasing too.

As you’ve probably seen in the news over the last week or so, tens of thousands of e-mail accounts have been compromised and had their log-in details posted online. Furthermore, the problem was not down to security weaknesses in Google Mail, Hotmail/Live Mail or Yahoo Mail. The problem was users giving out their information to anyone who asked.

You’re a web user. You do your shopping and banking online, always involving your confidential financial information. Perhaps you even pay the utility bills and taxes through online services. Chances are there is an awful lot of your information circulating on the internet.

So, if someone e-mailed you, claiming to be your bank, and asked for your bank account or credit card details, would you hand them over? Picture it this way – if the same person came up to you on the street and said that they were a representative of your bank, would you give the information to them, then and there? Probably not, if you had any sense!

While people may be more savvy about this threat, they seem not to be so sharp when it comes to ‘less important’ matters such as e-mail or social networking accounts. It seems tens of thousands of people have been more than happy to provide their usernames and passwords to anyone who asks, or to put those details into questionable forms on the web. When their data gets accessed, stolen or tampered with, they all of a sudden blame the services rather than themselves. This wouldn’t be so bad if every service didn’t say something like “Never give your information to anyone, ever – we will never ask for it” when you signed up!

What you have here is a deadly combination – stupid users and high tech con artists. Users are stupid in the way that they are wary in certain areas of the internet, but not in others – while they wouldn’t give a stranger their credit card details, they will give them their e-mail account details (which more often than not contains enough confidential information to sign up for a new credit card in your name!). Meanwhile, con artists are using ever more high tech methods to get people’s information – and succeeding.

Remember this golden rule: trust no-one. If someone is asking you about your information, chances are they aren’t supposed to have access to it. So, lesson to be learned? Don’t be a stupid user – get smart.

Researchers in the University of Tokyo have come up with a new paint to stop electromagnetic waves on frequencies utilised by wireless networks, in order to help secure wireless networks in sensitive locations.

The paint contains aluminium-iron oxide particles which absorb the signals, meaning no transmissions should find their way in, or out, of a room painted with the substance. At the moment the team is targeting a cost of around £10/kg.

However, this is just another specialisation or improvement on existing electromagnetic shielding paints which have been available for a long time. In the past, these have been designed to combat a variety of signal wavelengths, from radio transmissions to TV and even mobile phones.

Wireless LAN technology currently works in the 100GHz range, which is much higher than the ranges currently catered for with shielding paint. Possible uses in the future could include movie theatres to stop people’s phones going off during a showing, businesses who share sensitive information over wireless networks and medical facilities.

Although it is certainly expensive to redecorate, it could help bolster security in certain businesses, but it has been stressed by security experts that nothing will ever replace or remove the need for adequate encryption and other security protocols. Home users are advised to secure their home networks, especially as more and more users switch to wireless networking technology and store more sensitive information than ever on their home computers.

 
October 1st, 2009
 

The US government has continued with its cyber-security initiative this year, with the main focus being what they term “cyber hygiene”. They want people to think more about the information they divulge over the internet and to be more wary of messages they receive via e-mail and social networking.

With the numbers of phishing attacks rising, organisers are keen to convince users that they should be suspicious of all messages from banks and other organisations, to ensure their personal data is not compromised. Of course, all banks and financial institutions already tell their customers to never divulge account information and that their staff will never ask for it, but it seems some people are still falling for some of the oldest online scams.

419 attacks, involving using someone’s identity to ask friends and acquaintances for money, are also on the rise. These attacks usually take place over social networks like Twitter and Facebook, but can also happen over instant messaging networks.

Security experts are also warning people to be ever-cautious of the information they divulge in the public domain, seeing as determined criminals can gather enough personal information over a wide spread of mediums to build up a convincing fake message with which to scam friends and relatives.

Let’s hope this initiative works out well and gives people enough information about how to avoid being scammed over the internet.

« Previous EntriesNext Entries »