We want to expose one myth right now: while proponents of UNIX-based systems like Apple Mac OS X and Linux like to tout the supposed security benefits of their systems over Windows, the truth is that these competitors benefit primarily from security by obscurity. That is, so few people use these systems relative to Windows that hackers don’t bother targeting the minority operating systems. Consider this: in 2007, the installed base of Windows-based PCs exceeded 1 billion, but the maker of the number-two OS, Apple, claims just 25 million users. That’s right, only 2.5 percent of the Windows user base is using the number-two most frequently used OS on earth. Hackers may be evil but they’re not dummies: they know where the numbers are.
This isn’t a partisan attack on Mac OS X or Linux. Both are fine systems, with their own particular strengths; and as far as security by obscurity goes, it’s certainly a valid enough reason to consider using OS X or Linux instead of Windows. It’s one of the reasons we both use Mozilla Firefox instead of Internet Explorer: in addition to various features that Firefox offers, the browser is hacked a lot less often than IE simply because fewer people use it.
Source of Information : Wiley Windows 7 Secrets (2009)
Showing posts with label Windows Security. Show all posts
Showing posts with label Windows Security. Show all posts
Types of Malware
Malicious software comes in many forms. All forms have certain things in common, though. For one, they’re invisible — you don’t even know they’re there. For another, they all do something bad, something you don’t really want happening on your computer. Third, they’re all written by human programmers to intentionally do these bad things. The differences have to do with how they spread and what they do after they’re on your computer. I tell you about the differences in the sections to follow.
Viruses and worms
Viruses and worms are self-replicating programs that spread from one computer to the next, usually via the Internet. A virus needs a host file to spread from one computer to the next. The host file can be anything, though viruses are typically hidden in e-mail attachments and programs you download.
A worm is similar to a virus in that it can replicate itself and spread. However, unlike a virus, a worm doesn’t need a host file to travel around. It can go from one computer to the next right though your Internet connection. That’s one reason it’s important to always have a firewall up when you’re online — to keep out worms that travel through Internet connections.
The harm caused by viruses and worms ranges from minor pranks to serious damage. A minor prank might be something like a small message that appears somewhere on your screen where you don’t want it. A more serious virus might erase important files, or even try to erase all your files, rendering your computer useless.
Spyware and adware
Spyware and adware is malware that’s not designed to specifically harm your computer. Rather, it’s designed to help people sell you stuff. A common spyware tactic is to send information about the Web sites you visit to computers that send out advertisements on the Internet. That computer analyzes the Web sites you visit to figure out what types of products you’re most likely to buy. That computer then sends ads about such products to your computer.
Adware is the mechanism that allows ads to appear on your computer screen. When you get advertisements on your screen, seemingly out of the clear blue sky, there’s usually some form of adware behind it. Spyware and adware often work in conjunction with one another. The adware provides the means to display ads. The spyware helps the ad server (the computer sending the ads) choose ads for products you’re most likely to buy.
Trojan horses and rootkits
You may have heard the term Trojan horse in relation to early mythology. The story goes like this. After 10 years of war with the city of Troy, the Greeks decided to call it quits. As a peace offering, they gave to the people of Troy a huge horse statue named the Trojan horse. While the people of Troy were busy celebrating the end of the war, Greek soldiers hidden inside the horse snuck out and opened the gates to the city from inside. This allowed other Greek soldiers, lying in wait hidden outside the city, to storm into the town and conquer it. (This is definitely a case in which it would have been wise to look a gift horse in the mouth.)
A Trojan horse is a program that works in a similar manner. In contrast to other forms of malware, a Trojan horse is a program you can actually see on your screen and use. On the surface, it does do something useful. However, hidden inside the program is some smaller program that does bad things, usually without your knowledge.
A Trojan horse can also be a program that hides nothing but could be used in bad ways. Take, for example, a program that can recover lost passwords. On the one hand, it can be a good thing if you use it to recover forgotten passwords from files you created yourself. But it can be a bad thing when used to break into other people’s password-protected files. A rootkit is a program that is capable of hiding itself, and the malicious intent of other programs, from the user and even from the system. As with Trojan horses, not all rootkits are inherently malicious. However, they can certainly be used in malicious ways. Windows 7 protects your system from rootkits on many fronts, including Windows Defender.
Source of Information : Windows 7 Bible (2009)
Viruses and worms
Viruses and worms are self-replicating programs that spread from one computer to the next, usually via the Internet. A virus needs a host file to spread from one computer to the next. The host file can be anything, though viruses are typically hidden in e-mail attachments and programs you download.
A worm is similar to a virus in that it can replicate itself and spread. However, unlike a virus, a worm doesn’t need a host file to travel around. It can go from one computer to the next right though your Internet connection. That’s one reason it’s important to always have a firewall up when you’re online — to keep out worms that travel through Internet connections.
The harm caused by viruses and worms ranges from minor pranks to serious damage. A minor prank might be something like a small message that appears somewhere on your screen where you don’t want it. A more serious virus might erase important files, or even try to erase all your files, rendering your computer useless.
Spyware and adware
Spyware and adware is malware that’s not designed to specifically harm your computer. Rather, it’s designed to help people sell you stuff. A common spyware tactic is to send information about the Web sites you visit to computers that send out advertisements on the Internet. That computer analyzes the Web sites you visit to figure out what types of products you’re most likely to buy. That computer then sends ads about such products to your computer.
Adware is the mechanism that allows ads to appear on your computer screen. When you get advertisements on your screen, seemingly out of the clear blue sky, there’s usually some form of adware behind it. Spyware and adware often work in conjunction with one another. The adware provides the means to display ads. The spyware helps the ad server (the computer sending the ads) choose ads for products you’re most likely to buy.
Trojan horses and rootkits
You may have heard the term Trojan horse in relation to early mythology. The story goes like this. After 10 years of war with the city of Troy, the Greeks decided to call it quits. As a peace offering, they gave to the people of Troy a huge horse statue named the Trojan horse. While the people of Troy were busy celebrating the end of the war, Greek soldiers hidden inside the horse snuck out and opened the gates to the city from inside. This allowed other Greek soldiers, lying in wait hidden outside the city, to storm into the town and conquer it. (This is definitely a case in which it would have been wise to look a gift horse in the mouth.)
A Trojan horse is a program that works in a similar manner. In contrast to other forms of malware, a Trojan horse is a program you can actually see on your screen and use. On the surface, it does do something useful. However, hidden inside the program is some smaller program that does bad things, usually without your knowledge.
A Trojan horse can also be a program that hides nothing but could be used in bad ways. Take, for example, a program that can recover lost passwords. On the one hand, it can be a good thing if you use it to recover forgotten passwords from files you created yourself. But it can be a bad thing when used to break into other people’s password-protected files. A rootkit is a program that is capable of hiding itself, and the malicious intent of other programs, from the user and even from the system. As with Trojan horses, not all rootkits are inherently malicious. However, they can certainly be used in malicious ways. Windows 7 protects your system from rootkits on many fronts, including Windows Defender.
Source of Information : Windows 7 Bible (2009)
Five Simple, Free Security Hacks
Security software is the lock on your PC’s front door, but you can also make that door less attractive to crooks.
Let’s talk about security hacks— simple yet clever ways to protect yourself and your PC that cost little or nothing. Here are my five favorites. It should go without saying that none of these can replace good, up-to-date antivirus and firewall protection, but they can make stealing your system or data difficult or unappealing.
1. It’s simple, yet surprisingly effective: Remove the keyboard and mouse. It’s highly unlikely that a snoop will carry an extra keyboard and mouse with him. This will slow someone down but is far from foolproof, and it should go without saying that every computer should be physically locked to a sturdy object and secured behind a strong password.
2. To protect from podslurping (the connecting of an unauthorized USB device and its use to steal data), disable your USB ports. Or—and we borrowed this one directly from the U.S. military— epoxy over the USB ports. Too permanent? A slightly more elegant solution is to open the PC case and disconnect (or cut) the wires running from the motherboard to the USB ports.
3. Traveling with a laptop? Try not to advertise that you’re carrying a valuable piece of equipment: Use a computer bag that doesn’t look like a computer bag, or use a neoprene sleeve inside a regular backpack. If you nap at the airport, wrap the shoulder strap around your arm or leg so you’ll be alerted if someone tries to walk away with your bag.
4. Here’s an easy way to hide your Windows PC on a network while maintaining access to network resources. (This also works when you want stealth but still want to let others access your shared resources.) At the command prompt, type
Net config server /hidden:yes
Now you’re still a member of your network neighborhood, but your PC won’t show up when others browse for it. Make sure your software firewall is turned on, and block incoming ICMP traffic. This will prevent a network intruder from scanning for your PC using a ping sweep. Once you are hidden on the network, you can spend some time trying to figure out who, if anyone, is connecting to your PC and to whom your PC is connecting. To accomplish this, you’ll use the command-line tool Netstat and the Task Manager. Get to the command prompt and type
netstat –ao
A bunch of info will flash by on your screen listing the type of connection, the IP addresses of remote hosts, the protocols, and the process identifier, or PID. If there’s something here you don’t recognize, write down the PID. Now, open the Task Manager and add the PID column by opening the View menu and clicking on Select Columns. Check the box next to PID. Now match the PID from Netstat and the PID from Task Manager to learn which applications are holding which ports open. A well-secured machine should have ports open only for authorized apps.
5. One last idea: Enabling secure logon in Windows XP and Vista will protect your system from malware that attempts to impersonate a log-on screen to steal system passwords. This forces anyone trying to log on to press Ctrl-Alt-Del first. In Windows Vista, open the Run command, type netplwiz, and click Continue when prompted by User Account Control. In the Advanced User Account window, click the Advanced tab, then select the box that says Require users to press Ctrl-Alt-Delete. In Windows XP, go to the Control Panel’s User Accounts applet. In the Advanced User Account window, click the Advanced tab, then select the box that says Require users to press Ctrl-Alt-Delete.
Source of Information : PC Magazine July 2009
Let’s talk about security hacks— simple yet clever ways to protect yourself and your PC that cost little or nothing. Here are my five favorites. It should go without saying that none of these can replace good, up-to-date antivirus and firewall protection, but they can make stealing your system or data difficult or unappealing.
1. It’s simple, yet surprisingly effective: Remove the keyboard and mouse. It’s highly unlikely that a snoop will carry an extra keyboard and mouse with him. This will slow someone down but is far from foolproof, and it should go without saying that every computer should be physically locked to a sturdy object and secured behind a strong password.
2. To protect from podslurping (the connecting of an unauthorized USB device and its use to steal data), disable your USB ports. Or—and we borrowed this one directly from the U.S. military— epoxy over the USB ports. Too permanent? A slightly more elegant solution is to open the PC case and disconnect (or cut) the wires running from the motherboard to the USB ports.
3. Traveling with a laptop? Try not to advertise that you’re carrying a valuable piece of equipment: Use a computer bag that doesn’t look like a computer bag, or use a neoprene sleeve inside a regular backpack. If you nap at the airport, wrap the shoulder strap around your arm or leg so you’ll be alerted if someone tries to walk away with your bag.
4. Here’s an easy way to hide your Windows PC on a network while maintaining access to network resources. (This also works when you want stealth but still want to let others access your shared resources.) At the command prompt, type
Net config server /hidden:yes
Now you’re still a member of your network neighborhood, but your PC won’t show up when others browse for it. Make sure your software firewall is turned on, and block incoming ICMP traffic. This will prevent a network intruder from scanning for your PC using a ping sweep. Once you are hidden on the network, you can spend some time trying to figure out who, if anyone, is connecting to your PC and to whom your PC is connecting. To accomplish this, you’ll use the command-line tool Netstat and the Task Manager. Get to the command prompt and type
netstat –ao
A bunch of info will flash by on your screen listing the type of connection, the IP addresses of remote hosts, the protocols, and the process identifier, or PID. If there’s something here you don’t recognize, write down the PID. Now, open the Task Manager and add the PID column by opening the View menu and clicking on Select Columns. Check the box next to PID. Now match the PID from Netstat and the PID from Task Manager to learn which applications are holding which ports open. A well-secured machine should have ports open only for authorized apps.
5. One last idea: Enabling secure logon in Windows XP and Vista will protect your system from malware that attempts to impersonate a log-on screen to steal system passwords. This forces anyone trying to log on to press Ctrl-Alt-Del first. In Windows Vista, open the Run command, type netplwiz, and click Continue when prompted by User Account Control. In the Advanced User Account window, click the Advanced tab, then select the box that says Require users to press Ctrl-Alt-Delete. In Windows XP, go to the Control Panel’s User Accounts applet. In the Advanced User Account window, click the Advanced tab, then select the box that says Require users to press Ctrl-Alt-Delete.
Source of Information : PC Magazine July 2009
Internet Security Suites
Security software firms keep experts on staff, ready to code an update at the first sign of a new virus, worm, botnet, rootkit, or other digital threat. Hence, most of us are willing to pay yearly subscriptions to the companies that keep our PCs safe. As you may know, it’s no longer enough to run a mere antivirus utility, even if it watches out for spyware and adware, too. Everyone needs a thirdparty firewall, despite the moderate protection afforded by Windows’ freebie. And a spam filter does more than just divert junk messages to the trash; it also blocks harmful content from reaching your inbox. Thus, it’s a good idea to install a full security suite instead of a hodgepodge of standalone security programs. Not only can a suite save you money, but its anti-malware components are generally made to work well together without getting in each other’s way. Let’s take a look at some attractive options. All of the following have earned reputations as being fairly reliable and effective. Pricing includes a year’s worth of free updates and upgrades.AVG Internet Security 8.0.196
AVG Free, the free version of AVG Anti-Virus Pro, is a familiar sight on Windows computers around the world. More robust versions start at $34.99. This $54.99 suite is the top of the heap, giving you a firewall and protection against rootkits, antivirus, and antispyware. AVG Internet Security actively guards against malware infestations from the Web, IM (instant messaging) programs, peer-to-peer file-sharing software, your local network, spam, and other avenues. You can schedule regular scans and tell AVG when to update itself with new virus definitions.
AVG Internet Security’s special tools give you detailed insight into the processes running on your computer. This includes an editable list of the applications that automatically start up with your PC, along with its network connections, browser add-ons, and more. AVG’s friendly main panel is easy to understand. You get an at-a-glance overview of the types of security features AVG provides, along with color-coded descriptions of their statuses, such as “Active.” Double-click any of the icons here, and you’ll get a description of what each security feature does, along with a few settings in plain English. You’ll find all of the important functions in dropdown menus, too.
One option, enabled by default, is the AVG Security Toolbar. This integrates with your browser (it worked on Firefox 3 and Internet Explorer 7 for us) to warn you about phishing attacks (imposter sites), drive-by downloads, and sites known to host malware. When you use a common search engine, such as Google or Yahoo! Search, the Security Toolbar will check the list of results for known threats. You’ll see green check mark icons next to sites that are probably safe and red Xs next to URLs that likely lead to pages carrying malware. Note that AVG is the only suite here that you can only use on one PC at a time (a 3-PC version is $74.99). Also, some longtime users of
AVG have found that version 8 seriously slows down older PCs that could run versions and earlier without a problem. Then again, version 8 does provide AVG’s most comprehensive protection yet.
Kaspersky Internet Security 2009 8.0.0.454
Price may be keeping Kaspersky from being as popular in this country as it might be. A three-user download costs $79.95 per year, and there’s no discount for the one-user version on CD. Certainly, Kaspersky’s effectiveness is seldom questioned. Independent testing labs routinely award the software high marks in the fight against malware.
Besides the usual viruses and spyware, Kaspersky fights against rootkits, keyloggers, and hacker tools. The company provides updates every hour, something not all antivirus vendors can say. There’s a firewall, antispam capability, IM protection, antiphishing, and parental controls to limit the types of online content particular users can access and the hours they can access the Web. KIS even offers a virtual keyboard you can use if you’re worried about a keylogger recording what you type on your physical keyboard. Also included is a privacy scanner tool, which lists areas of personally identifying data you can opt to select and secure with one click. With small RAM requirements and intelligent work scheduling, Kaspersky is optimized for performance on PCs used to play games. Its fast scanning automatically takes place in the background, and it lets other apps have priority when it comes to CPU cycles.
KIS is highly effective at protecting itself from threats that try to shut down antivirus utilities. It lets you password-protect its settings and operation, too, so attempts to shut it down won’t work without the magic word. It even checks the applications installed on your PC for known vulnerabilities. All this with a colorful, intuitive main panel that offers easy access to powerful settings.
McAfee Internet Security 2009
Like Trend Micro and Symantec below, McAfee’s stated goal with this latest suite is to speed up threat detection without slowing down your PC. Its $59.99 license covers three PCs. You’ll get a backup and restore function with this suite. Another feature is McAfee QuickClean, which eliminates junk files, caches, deleted email, and obsolescent Registry entries. There’s a file shredder and links to Windows’ System Restore and Disk Defragmenter. McAfee’s GUI (graphical user interface) may have fewer icons than other suites, but dig around and you’ll find some eye candy. Visual Tracer lets you enter the IP (Internet protocol) address of an unknown computer—perhaps one that tried to contact your own PC—and shows you on a map where it might be located, assuming the IP number hasn’t been faked. There are links to color-coded maps of hacker and virus activity, too.
A network manager gives you a simple, clear view of the computers on your LAN, plus their connections to your router, the Internet, and each other. Meanwhile, EasyNetwork helps you set up secure file- and printersharing on your network, something most mainstream users will welcome. Google, MSN, and Yahoo! search engines will benefit from SiteAdvisor, which works like AVG’s Security Toolbar to warn you of dangerous sites. Mc-Afee also offers parental controls over Web sites and keywords, as well as identity and password-protection features. Of course there are also anti-malware and firewall features plus email, Webmail, and IM protection. Virus updates don’t hog a PC’s full attention, either.
PC Tools Internet Security 2009
A relative newcomer, PC Tools (now part of Symantec) has quickly built a great reputation in the antivirus/antispyware field. PC Tools’ IntelliGuard components ward off threats old and new, such as rootkits and phishing attacks. Meanwhile, its Browser Defender toolbar rates sites’ threat levels and checks for malware, pop-ups, and so on. This suite includes antispam and firewall features, too. The former gives you very granular control, letting you choose the spam blacklisting services you want to use (if any) and even letting you block email from entire countries.
The firewall offers a stealth mode to make no response to unauthorized attempts to communicate with your PC, along with powerful stateful packet inspection for rigorous analysis of each bit of data moving in or out. An initial scan at installation found some items the competition missed. These were mainly tracking cookies, but one was a cookie linked to a site known to be compromised by malware. Note that to remove any found threats with PC Tools’ 15-day free trial, you’ll need to register and get an activation code.
Symantec Norton Internet Security 2009
Symantec is getting its act together. For years, Norton has been the only name in many users’ minds regarding antivirus software, offering effective protection and complete feature sets. Then again, Norton has long tended to bog down PCs. Updates seem to take forever and sometimes require more than one session. Installation is a hassle. Some Norton products cause frequent errors such as shutdown hangs. Symantec also has had to work to improve how quickly it issues virus definition updates when new threats appear. With version 2009, Norton’s new “60-second” installation is certainly speedier than before. Scanning was similarly fast, beating even the fleet-footed Kaspersky by 10 seconds or so. Norton appeared to take great advantage of all four cores in our test PC’s processor during its scan and appropriated less than 10MB of RAM when idle. Even LiveUpdate ran so quickly, we thought at first that it had malfunctioned. This three-PC suite features a goodlooking control panel with well-designed on/off icons. From a network map to ID theft prevention technology, there isn’t much the competition has that this version of Norton doesn’t— and this year, the list of Norton’s “haves” includes performance.
Trend Micro Internet Security Pro 17.0.1224
There’s a $49.95 version of Trend Micro’s Internet Security suite, but we’ll look at the $69.95 Pro edition. Pro has personal ID data protection, PC speed-up utilities, and enhanced security features for smartphones, email, and IM. The company has pledged to speed up threat identification and reduce its software’s impact on PC performance.
Remote File Lock is an encrypted storage area that lets you irreversibly block access to your data over the Web should anyone steal your notebook or PC. The Software History Cleaner can automatically purge your OS, as well as certain browsers, media players, IM clients, and other software, of data that could tell someone the kinds of files and Web sites you’ve been accessing.
There’s Wi-Fi defense for when you set up your laptop in a hotspot, and the Personal Firewall can automatically change its security profile when you move from your home connection to a coffee shop, for example. Unfortunately, the network map, unlike Norton’s and McAfee’s, didn’t notice the other PCs and the router on our LAN. Finally, Trend Micro’s First Visitor Protection scans a Web site you have never visited before to make sure that there are no nasty surprises waiting for you in the wings. Trend Micro found fewer concerns on our PC than some of the other suites here, and it automatically deleted three tracking cookies without asking permission. Still, the company offers month-long trial versions as well as a 30-day moneyback guarantee.
Scanning Speeds
Each suite defines a “full” scan differently, so take these results of our informal scanning speed test with a grain of salt. In order from fastest (15 minutes, 35 seconds) to slowest (44:30) were Norton, Kaspersky, PC Tools, Trend Micro, McAfee, and AVG, all at their default settings. Whatever the speed, you’ll enjoy effective protection of your data with just about any of the above suites.
Source of Information : Smart Computing / January 2009
How PKI Works
Perhaps helpful to understand the term encryption and how PKI has evolved. The history of general cryptography almost certainly dates back to almost 2000 B.C. when Roman and Greek statesmen used simple alphabet-shifting algorithms to keep government communication private. Through time and civilizations, ciphering text played an important role in wars and politics. As modern times provided new communication methods, scrambling information became increasingly more important. World War II brought about the first use of the computer in the cracking of Germany’s Enigma code. In 1952, President Truman created the National Security Agency at Fort Meade, Maryland. This agency, which is the center of U.S. cryptographic activity, fulfills two important national functions: It protects all military and executive communication from being intercepted, and it intercepts and unscrambles messages sent by other countries.
Although complexity increased, not much changed until the 1970s, when the National Security Agency (NSA) worked with Dr. Horst Feistel to establish the Data Encryption Standard (DES) and Whitfield Diffie and Martin Hellman introduced the first public key cryptography standard. Windows Server 2008 still uses Diffie-Hellman (DH) algorithms for SSL, Transport Layer Security (TLS), and IPSec. Another major force in modern cryptography came about in the late 1970s. RSA Labs, founded by Ronald Rivest, Adi Shamir, and Leonard Adleman, furthered the concept of key cryptography by developing a technology of key pairs, where plaintext that is encrypted by one key can be decrypted only by the other matching key.
There are three types of cryptographic functions. The hash function does not involve the use of a key at all, but it uses a mathematical algorithm on the data in order to scramble it. The secret key method of encryption, which involves the use of a single key, is used to encrypt and decrypt the information and is sometimes referred to as symmetric key cryptography. An excellent example of secret key encryption is the decoder ring you may have had as a child. Any person who obtained your decoder ring could read your “secret” information.
There are basically two types of symmetric algorithms. Block symmetric algorithms work by taking a given length of bits known as blocks. Stream symmetric algorithms operate on a single bit at a time. One well-known block algorithm is DES. Windows 2000 uses a modified DES and performs that operation on 64-bit blocks using every eighth bit for parity. The resulting ciphertext is the same length as the original cleartext.
For export purposes the DES is also available with a 40-bit key. One advantage of secret key encryption is the efficiency with which it takes a large amount of data and encrypts it quite rapidly. Symmetric algorithms can also be easily implemented at the hardware level. The major disadvantage of secret key encryption is that a single key is used for both encryption and decryption. There must be a secure way for the two parties to exchange the one secret key.
In the 1970s this disadvantage of secret key encryption was eliminated through the mathematical implementation of public key encryption. Public key encryption, also referred to as asymmetric cryptography, replaced the one shared key with each user’s own pair of keys. One key is a public key, which is made available to everyone and is used for the encryption process only. The other key in the pair, the private key, is available only to the owner. The private key cannot be created as a result of the public key’s being available. Any data that is encrypted by a public key can be decrypted only by using the private key of the pair. It is also possible for the owner to use a private key to encrypt sensitive information. If the data is encrypted by using the private key, then the public key in the pair of keys is needed to decrypt the data. DH algorithms are known collectively as shared secret key cryptographies, also known as symmetric key encryption. Let’s say we have two users, Greg and Matt, who want to communicate privately. With DH, Greg and Matt each generate a random number.
Each of these numbers is known only to the person who generated it. Part one of the DH function changes each secret number into a nonsecret, or public, number. Greg and Matt now exchange the public numbers and then enter them into part two of the DH function. This results in a private key—one that is identical to both users. Using advanced mathematics, this shared secret key can be decrypted only by someone with access to one of the original random numbers. As long as Greg and Matt keep the original numbers hidden, the shared secret key cannot be reversed.
It should be apparent from the many and varied contributing sources to PKI technology that the need for management of this invaluable set of tools would become paramount. If PKI, like any other technology set, continued to develop without standards of any kind, then differing forms and evolutions of the technology would be implemented ad hoc throughout the world. Eventually, the theory holds that some iteration would render communication or operability between different forms impossible. At that point, the cost of standardization would be significant, and the amount of time lost in productivity and reconstruction of PKI systems would be immeasurable. Thus, a set of standards was developed for PKI. The Public-Key Cryptography Standards (PKCS) are a set of standard protocols sued for securing the exchange of information through PKI. The list of these standards was actually established by RSA laboratories—the same organization that developed the original RSA encryption standard—along with a group of participating technology leaders that included Microsoft, Sun, and Apple.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Although complexity increased, not much changed until the 1970s, when the National Security Agency (NSA) worked with Dr. Horst Feistel to establish the Data Encryption Standard (DES) and Whitfield Diffie and Martin Hellman introduced the first public key cryptography standard. Windows Server 2008 still uses Diffie-Hellman (DH) algorithms for SSL, Transport Layer Security (TLS), and IPSec. Another major force in modern cryptography came about in the late 1970s. RSA Labs, founded by Ronald Rivest, Adi Shamir, and Leonard Adleman, furthered the concept of key cryptography by developing a technology of key pairs, where plaintext that is encrypted by one key can be decrypted only by the other matching key.
There are three types of cryptographic functions. The hash function does not involve the use of a key at all, but it uses a mathematical algorithm on the data in order to scramble it. The secret key method of encryption, which involves the use of a single key, is used to encrypt and decrypt the information and is sometimes referred to as symmetric key cryptography. An excellent example of secret key encryption is the decoder ring you may have had as a child. Any person who obtained your decoder ring could read your “secret” information.
There are basically two types of symmetric algorithms. Block symmetric algorithms work by taking a given length of bits known as blocks. Stream symmetric algorithms operate on a single bit at a time. One well-known block algorithm is DES. Windows 2000 uses a modified DES and performs that operation on 64-bit blocks using every eighth bit for parity. The resulting ciphertext is the same length as the original cleartext.
For export purposes the DES is also available with a 40-bit key. One advantage of secret key encryption is the efficiency with which it takes a large amount of data and encrypts it quite rapidly. Symmetric algorithms can also be easily implemented at the hardware level. The major disadvantage of secret key encryption is that a single key is used for both encryption and decryption. There must be a secure way for the two parties to exchange the one secret key.
In the 1970s this disadvantage of secret key encryption was eliminated through the mathematical implementation of public key encryption. Public key encryption, also referred to as asymmetric cryptography, replaced the one shared key with each user’s own pair of keys. One key is a public key, which is made available to everyone and is used for the encryption process only. The other key in the pair, the private key, is available only to the owner. The private key cannot be created as a result of the public key’s being available. Any data that is encrypted by a public key can be decrypted only by using the private key of the pair. It is also possible for the owner to use a private key to encrypt sensitive information. If the data is encrypted by using the private key, then the public key in the pair of keys is needed to decrypt the data. DH algorithms are known collectively as shared secret key cryptographies, also known as symmetric key encryption. Let’s say we have two users, Greg and Matt, who want to communicate privately. With DH, Greg and Matt each generate a random number.
Each of these numbers is known only to the person who generated it. Part one of the DH function changes each secret number into a nonsecret, or public, number. Greg and Matt now exchange the public numbers and then enter them into part two of the DH function. This results in a private key—one that is identical to both users. Using advanced mathematics, this shared secret key can be decrypted only by someone with access to one of the original random numbers. As long as Greg and Matt keep the original numbers hidden, the shared secret key cannot be reversed.
It should be apparent from the many and varied contributing sources to PKI technology that the need for management of this invaluable set of tools would become paramount. If PKI, like any other technology set, continued to develop without standards of any kind, then differing forms and evolutions of the technology would be implemented ad hoc throughout the world. Eventually, the theory holds that some iteration would render communication or operability between different forms impossible. At that point, the cost of standardization would be significant, and the amount of time lost in productivity and reconstruction of PKI systems would be immeasurable. Thus, a set of standards was developed for PKI. The Public-Key Cryptography Standards (PKCS) are a set of standard protocols sued for securing the exchange of information through PKI. The list of these standards was actually established by RSA laboratories—the same organization that developed the original RSA encryption standard—along with a group of participating technology leaders that included Microsoft, Sun, and Apple.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
What Is a TPM?
A Trusted Platform Module (TPM) is a microchip that provides some basic security-related functions, mostly ones that involve encryption keys. To be considered secure, the TPM is installed permanently on the motherboard of a computer. The TPM uses a hardware bus to talk to the rest of the system.
A classic problem with any software-based security solution is that if an attacker can insert malicious code before the security software, then the security software can be circumvented. It is also difficult to be confident that any software reporting on its own state can be trusted. Think of rootkits, for example. They make the OS lie. Once you can fake out the OS, what can you trust?
So, a TPM helps address this problem because it can build a chain of trust that starts with hardware. Since this trust begins in hardware, there isn't any practical way to insert malicious code "before" the TPM. The TPM actually validates components of the platform (the computer) and the early boot process very reliably, and BitLocker can rely on this validation.
In many ways, a TPM is similar to a smart card. Although a TPM doesn't store certificates, it can create keys for cryptography and also keep private key permanently within the TPM. If a key created in a TPM is never exposed to any other component, software, process, or person, then, since the private key is never released outside the TPM, it's pretty darn hard to compromise. Because the TPM uses its own internal firmware and logic circuits for processing instructions, it does not rely on the operating system and is not exposed to external software vulnerabilities.
The TPM can also encrypt data provided by the OS, such as symmetric keys used to encrypt large blocks of data. When this type of data is encrypted by the TPM, it can only be decrypted again by the same TPM. This process, often called "wrapping" or "binding" a key, can help protect the key from disclosure. (Sometimes the data being wrapped is called a "blob of data," but "blob" can have a lot of meanings.)
Each TPM has a master "wrapping" key, called the Storage Root Key (SRK), which is stored (and kept) within the TPM itself. A TPM must also have an Endorsement Key (EK), which is permanent once set for that TPM. Other keys are derived from or signed by the EK.
Every time the computer starts, certain measurements are made and stored in the TPM's platform control registers (PCRs). PCRs are discussed in more detail later in this chapter. Accordingly, computers that incorporate a TPM can also create a key that has not only been wrapped, but also tied to specific platform measurements in the PCRS. This type of key can only be unwrapped when those platform measurements have the same values that they had when the key was created. This process is called "sealing" the key to the TPM. Decrypting it is called "unsealing." The TPM can also seal and unseal data generated outside of the TPM. With a sealed key and software like BitLocker, you can lock data until specific hardware or software conditions are met. This process is the basis for the pre-OS boot component validation performed by BitLocker.
There is some bad news, though. To use a TPM, BitLocker requires a TPM that meets the version 1.2 standard, set by the Trusted Computing Group (TCG). If your computer is older than 2006, it is very unlikely to have a version 1.2 TPM (most computers existing today don't have a TPM at all). In addition to having a compatible TPM, your computer must also have compatible BIOS. Most computer manufacturers are releasing Vista-compatible BIOS updates for computers that have version 1.2 TPM chips.
For more information about the TPM specifications, you can visit https://www.trustedcomputinggroup.org/specs/TPM. TPM chip manufacturers work with the computer manufacturers, and generally ensure that the TPM meets encryption export requirements, and they may seek certification from various authorities. One example of a TPM chip in common use is the line by Infineon, featured at http://www.infineon.com (http://www.infineon.com/cgi-bin/ifx/portal/ep/channelView.do?channelId=-84648&channelPage=%2Fep%2Fchannel%2FproductOverview.jsp&pageTypeId=17099).
Don't despair: computers that lack a compatible TPM can still use the encryption features of BitLocker, provided their BIOS supports access to a USB flash memory device during the early boot process. There are a lot more of these computers around.
Source of Information : Administering Windows Vista Security The Big Surprises
A classic problem with any software-based security solution is that if an attacker can insert malicious code before the security software, then the security software can be circumvented. It is also difficult to be confident that any software reporting on its own state can be trusted. Think of rootkits, for example. They make the OS lie. Once you can fake out the OS, what can you trust?
So, a TPM helps address this problem because it can build a chain of trust that starts with hardware. Since this trust begins in hardware, there isn't any practical way to insert malicious code "before" the TPM. The TPM actually validates components of the platform (the computer) and the early boot process very reliably, and BitLocker can rely on this validation.
In many ways, a TPM is similar to a smart card. Although a TPM doesn't store certificates, it can create keys for cryptography and also keep private key permanently within the TPM. If a key created in a TPM is never exposed to any other component, software, process, or person, then, since the private key is never released outside the TPM, it's pretty darn hard to compromise. Because the TPM uses its own internal firmware and logic circuits for processing instructions, it does not rely on the operating system and is not exposed to external software vulnerabilities.
The TPM can also encrypt data provided by the OS, such as symmetric keys used to encrypt large blocks of data. When this type of data is encrypted by the TPM, it can only be decrypted again by the same TPM. This process, often called "wrapping" or "binding" a key, can help protect the key from disclosure. (Sometimes the data being wrapped is called a "blob of data," but "blob" can have a lot of meanings.)
Each TPM has a master "wrapping" key, called the Storage Root Key (SRK), which is stored (and kept) within the TPM itself. A TPM must also have an Endorsement Key (EK), which is permanent once set for that TPM. Other keys are derived from or signed by the EK.
Every time the computer starts, certain measurements are made and stored in the TPM's platform control registers (PCRs). PCRs are discussed in more detail later in this chapter. Accordingly, computers that incorporate a TPM can also create a key that has not only been wrapped, but also tied to specific platform measurements in the PCRS. This type of key can only be unwrapped when those platform measurements have the same values that they had when the key was created. This process is called "sealing" the key to the TPM. Decrypting it is called "unsealing." The TPM can also seal and unseal data generated outside of the TPM. With a sealed key and software like BitLocker, you can lock data until specific hardware or software conditions are met. This process is the basis for the pre-OS boot component validation performed by BitLocker.
There is some bad news, though. To use a TPM, BitLocker requires a TPM that meets the version 1.2 standard, set by the Trusted Computing Group (TCG). If your computer is older than 2006, it is very unlikely to have a version 1.2 TPM (most computers existing today don't have a TPM at all). In addition to having a compatible TPM, your computer must also have compatible BIOS. Most computer manufacturers are releasing Vista-compatible BIOS updates for computers that have version 1.2 TPM chips.
For more information about the TPM specifications, you can visit https://www.trustedcomputinggroup.org/specs/TPM. TPM chip manufacturers work with the computer manufacturers, and generally ensure that the TPM meets encryption export requirements, and they may seek certification from various authorities. One example of a TPM chip in common use is the line by Infineon, featured at http://www.infineon.com (http://www.infineon.com/cgi-bin/ifx/portal/ep/channelView.do?channelId=-84648&channelPage=%2Fep%2Fchannel%2FproductOverview.jsp&pageTypeId=17099).
Don't despair: computers that lack a compatible TPM can still use the encryption features of BitLocker, provided their BIOS supports access to a USB flash memory device during the early boot process. There are a lot more of these computers around.
Source of Information : Administering Windows Vista Security The Big Surprises
BitLocker Components
BitLocker contains four main components: a single Microsoft TPM driver, an API called TPM Base Services (TBS), BitLocker Drive Encryption, and a WMI provider.
Like most hardware, a TPM chip needs a driver to expose its functionality to the operating system and, ultimately, to applications. By including the Microsoft TPM driver within Windows Vista, we gain increased stability and can more easily leverage the TPM's security features. To use a TPM with BitLocker, you must allow Vista to use the Microsoft driver. The Microsoft driver works with TPM chips that are at version 1.2 or newer.
TPM Base Services (TBS) is an application programming interface (API) that allows applications to access the services provided by a TPM. In this aspect, even though it is part of the Windows operating system, BitLocker is an "application" that uses TBS. The advantage of this architecture is that other applications could also make use of the TPM. After Vista is in the marketplace for a while, I believe we will see other security applications that call on TBS. TBS also allows the TPM to be managed within Windows Vista from the TPM Management Console, instead of forcing users to navigate through endless BIOS screens.
BitLocker Drive Encryption, itself, is the OS component that encrypts and decrypts data on the volume, and uses the TPM to validate the pre-OS boot components. BitLocker has a number of options that can change its default behavior, many of which are exposed through Group Policy settings.
BitLocker is also totally scriptable and manageable. In addition to Group Policy options, BitLocker and TBS both include Windows Management Interface (WMI) providers. WMI is the Windows implementation of Web-Based Enterprise Management (WBEM), so any WBEM console can also be used with BitLocker. More usefully, though, this WMI interface allows BitLocker to be scripted, and Vista includes a scripted utility called manage-bde.wsf, which allows you to configure and control BitLocker from the command line or a batch file, either locally or remotely.
It is also worth noting here, even though we talk about it in more detail later in the chapter, BitLocker integrates with Active Directory Domain Services to store TPM and BitLocker information that can be used for recovery.
Source of Information : Administering Windows Vista Security The Big Surprises
Like most hardware, a TPM chip needs a driver to expose its functionality to the operating system and, ultimately, to applications. By including the Microsoft TPM driver within Windows Vista, we gain increased stability and can more easily leverage the TPM's security features. To use a TPM with BitLocker, you must allow Vista to use the Microsoft driver. The Microsoft driver works with TPM chips that are at version 1.2 or newer.
TPM Base Services (TBS) is an application programming interface (API) that allows applications to access the services provided by a TPM. In this aspect, even though it is part of the Windows operating system, BitLocker is an "application" that uses TBS. The advantage of this architecture is that other applications could also make use of the TPM. After Vista is in the marketplace for a while, I believe we will see other security applications that call on TBS. TBS also allows the TPM to be managed within Windows Vista from the TPM Management Console, instead of forcing users to navigate through endless BIOS screens.
BitLocker Drive Encryption, itself, is the OS component that encrypts and decrypts data on the volume, and uses the TPM to validate the pre-OS boot components. BitLocker has a number of options that can change its default behavior, many of which are exposed through Group Policy settings.
BitLocker is also totally scriptable and manageable. In addition to Group Policy options, BitLocker and TBS both include Windows Management Interface (WMI) providers. WMI is the Windows implementation of Web-Based Enterprise Management (WBEM), so any WBEM console can also be used with BitLocker. More usefully, though, this WMI interface allows BitLocker to be scripted, and Vista includes a scripted utility called manage-bde.wsf, which allows you to configure and control BitLocker from the command line or a batch file, either locally or remotely.
It is also worth noting here, even though we talk about it in more detail later in the chapter, BitLocker integrates with Active Directory Domain Services to store TPM and BitLocker information that can be used for recovery.
Source of Information : Administering Windows Vista Security The Big Surprises
BitLocker Drive Encryption-the Overview
A few years ago, Microsoft began a project called the Next Generation Secure Computing Base, and BitLocker is a direct result of that effort. In designing BitLocker, the System Integrity team in Windows wanted to come up with a solution that included laptop computers (note-books,) desktops, and servers, and provide a way to prevent thieves from using other operating systems or software hacking tools to break or bypass the protection provided by the Windows OS and the file system. That kind of prevention requires encryption.
BitLocker is also designed to provide a transparent user experience. In other words, unlike EFS or RMS, the user doesn't have to do anything complicated to configure and use the protection given by encryption, and the user (and you, the IT guru, and your colleagues in Legal Affairs) can be confident that everything is encrypted.
When Microsoft first started to talk about BitLocker (then called "secure startup"), it seemed like an interesting but impractical technology because it required a Trusted Platform Module (TPM) chip built-in to the computer. Thankfully, the Vista implementation of Bit-Locker, however, lets you encrypt any system so long as it's got a TPM chip, or else by using a compatible USB flash drive, USB port, and BIOS. (BIOS and USB compatibility is part of the testing done before a manufacturer can put a Vista logo on a computer.)
This allows BitLocker to be used on many existing computers. However, some incompatibilities will still be found. It's a good idea to test system, BIOS, and USB flash drive combinations before committing to a large roll-out.
Clearly, laptop computers are where you need to begin, because they are sometimes stolen and often lost. Desktops, too, are sometimes targeted for theft, or sometimes placed in less-than-secure environments (such as shared lobbies or offices without locked doors). BitLocker will also be included in Windows Server code-named "Longhorn" (and will actually offer additional supported features). Although I hope you don't misplace your server very often, servers are very high-value targets for theft. All of these types of computers contain sensitive data, such as IP and PII.
Source of Information : Administering Windows Vista Security The Big Surprises
BitLocker is also designed to provide a transparent user experience. In other words, unlike EFS or RMS, the user doesn't have to do anything complicated to configure and use the protection given by encryption, and the user (and you, the IT guru, and your colleagues in Legal Affairs) can be confident that everything is encrypted.
When Microsoft first started to talk about BitLocker (then called "secure startup"), it seemed like an interesting but impractical technology because it required a Trusted Platform Module (TPM) chip built-in to the computer. Thankfully, the Vista implementation of Bit-Locker, however, lets you encrypt any system so long as it's got a TPM chip, or else by using a compatible USB flash drive, USB port, and BIOS. (BIOS and USB compatibility is part of the testing done before a manufacturer can put a Vista logo on a computer.)
This allows BitLocker to be used on many existing computers. However, some incompatibilities will still be found. It's a good idea to test system, BIOS, and USB flash drive combinations before committing to a large roll-out.
Clearly, laptop computers are where you need to begin, because they are sometimes stolen and often lost. Desktops, too, are sometimes targeted for theft, or sometimes placed in less-than-secure environments (such as shared lobbies or offices without locked doors). BitLocker will also be included in Windows Server code-named "Longhorn" (and will actually offer additional supported features). Although I hope you don't misplace your server very often, servers are very high-value targets for theft. All of these types of computers contain sensitive data, such as IP and PII.
Source of Information : Administering Windows Vista Security The Big Surprises
How Hacker Obtaining Passwords
Attackers have several ways to get hold of your passwords. The following sections list them in order of ease of attack and prevalence (roughly speaking).
Ask for Them
An astonishing number of people, up to three-quarters in some studies, are willing to part with their passwords in trade for something they value more, like chocolate in one particular study (Wagner, 2004).
Capture the Passwords Themselves
Apart from just asking for them, the most fruitful, simplest, and possibly most common way to attack passwords today is to use a keystroke logger to capture them in plaintext as the user enters them. There are many different kinds of keystroke loggers. An innocuous option is using a hardware device that mounts between the keyboard and the computer and has onboard memory to hold all keystrokes. It can be surreptitiously installed or removed in a matter of seconds. Such a device will get access to everything that the computer sees, including all keystrokes, metadata such as typing cadence, and so on. A software program, commonly found in malware and spyware today, can also capture all keystrokes, and can typically capture metadata as well, not just passwords. Some of these include an automatic upload feature to a Web site or an Internet Relay Chat (IRC) channel. Others include a small Web server that the attacker can use to retrieve the goods.
However, the simplest and most direct route for an attacker to capture only passwords is to write a sub-authentication package. Windows, like any other industrial-strength operating system, includes functionality for third parties to extend its authentication subsystem to authenticate to other network devices. An attacker can, with just a few application programming interface (API) calls, write a sub-authentication package that will receive all passwords in plaintext when a user logs on. With some more effort, the attacker can augment the package with the same features as a more general keystroke logger, but generating far less noise because it is specialized to capture only passwords.
Both of the software options require administrative privileges to install, meaning that the attacker must first completely compromise the computer. Physical compromise would also be sufficient to install these types of tools; and it is quite telling that keystroke loggers are now found regularly on public access computers, especially at conferences.
Capture the Challenge-Response Sequence
It is rare that passwords are passed over the network in any form today, and even rarer to see new implementations of plaintext protocols such as FTP, POP, and Telnet. However, even with challenge-response protocols the attacker can often capture both the challenge and the response and attack the combination. It requires more calculations than attacking ordinary hashes, but can be very fruitful if the password is weak.
Capture the Hashes
This is the quintessential attack that everyone worries about. If an attacker has access to the password hashes, he can crack them or use them in some other way. There are several ways to crack them, as we shall see shortly. The most common way to capture the hashes is to compromise the authentication server that stores the passwords. Another option less common but equally valid—is to compromise a computer where someone is already logged on. When a user logs on, as I mentioned earlier, Windows caches that user’s NT hash in memory. An attacker with complete control over the computer can retrieve that hash and use it in the same way as any other hash. Again, this is a problem largely related to your operational practices.
Guessing Passwords
Finally, the attacker can simply try to guess passwords. This is the easiest method to remedy, and also the least fruitful, or at least it should be. Anyone who has an Internet-connected Windows computer and actually looks at the log files will see attempts at this. Most attackers use automated password “grinders” that attempt to log on using either Terminal Services or Windows Networking (Server Message Block, or SMB). The log-on actually an Internet Information Services log-on attempt, which I know only because the host does not respond on either Terminal Services or SMB across the Internet. The automated password grinders will typically try common user names, such as Administrator, with a dictionary of passwords. Shockingly, they must be successful enough with that approach to make it worthwhile to continue. Many people argue that you should rename the Administrator account to fool attackers, and some even say to create a decoy account called Administrator. This has absolutely no effect whatsoever. The error message is the same whether an account does not exist with the name Administrator or whether the attacker gets the password wrong. Therefore, from the attacker’s perspective, he cannot tell whether you have an account called Administrator. He can only tell that he did not get in. You can assure yourself that he will not get in simply by setting a reasonably strong password. For example, if the password is 15 characters long and seemingly random (meaning that it seems random from the attacker’s point of view) the attacker will have to try 542,086,379,860,909,058,354,552,242,176, or so, times before he succeeds. More than likely he will move on before he succeeds in guessing that password.
Source of Information : Microsoft Press Windows Server 2008 Security
Ask for Them
An astonishing number of people, up to three-quarters in some studies, are willing to part with their passwords in trade for something they value more, like chocolate in one particular study (Wagner, 2004).
Capture the Passwords Themselves
Apart from just asking for them, the most fruitful, simplest, and possibly most common way to attack passwords today is to use a keystroke logger to capture them in plaintext as the user enters them. There are many different kinds of keystroke loggers. An innocuous option is using a hardware device that mounts between the keyboard and the computer and has onboard memory to hold all keystrokes. It can be surreptitiously installed or removed in a matter of seconds. Such a device will get access to everything that the computer sees, including all keystrokes, metadata such as typing cadence, and so on. A software program, commonly found in malware and spyware today, can also capture all keystrokes, and can typically capture metadata as well, not just passwords. Some of these include an automatic upload feature to a Web site or an Internet Relay Chat (IRC) channel. Others include a small Web server that the attacker can use to retrieve the goods.
However, the simplest and most direct route for an attacker to capture only passwords is to write a sub-authentication package. Windows, like any other industrial-strength operating system, includes functionality for third parties to extend its authentication subsystem to authenticate to other network devices. An attacker can, with just a few application programming interface (API) calls, write a sub-authentication package that will receive all passwords in plaintext when a user logs on. With some more effort, the attacker can augment the package with the same features as a more general keystroke logger, but generating far less noise because it is specialized to capture only passwords.
Both of the software options require administrative privileges to install, meaning that the attacker must first completely compromise the computer. Physical compromise would also be sufficient to install these types of tools; and it is quite telling that keystroke loggers are now found regularly on public access computers, especially at conferences.
Capture the Challenge-Response Sequence
It is rare that passwords are passed over the network in any form today, and even rarer to see new implementations of plaintext protocols such as FTP, POP, and Telnet. However, even with challenge-response protocols the attacker can often capture both the challenge and the response and attack the combination. It requires more calculations than attacking ordinary hashes, but can be very fruitful if the password is weak.
Capture the Hashes
This is the quintessential attack that everyone worries about. If an attacker has access to the password hashes, he can crack them or use them in some other way. There are several ways to crack them, as we shall see shortly. The most common way to capture the hashes is to compromise the authentication server that stores the passwords. Another option less common but equally valid—is to compromise a computer where someone is already logged on. When a user logs on, as I mentioned earlier, Windows caches that user’s NT hash in memory. An attacker with complete control over the computer can retrieve that hash and use it in the same way as any other hash. Again, this is a problem largely related to your operational practices.
Guessing Passwords
Finally, the attacker can simply try to guess passwords. This is the easiest method to remedy, and also the least fruitful, or at least it should be. Anyone who has an Internet-connected Windows computer and actually looks at the log files will see attempts at this. Most attackers use automated password “grinders” that attempt to log on using either Terminal Services or Windows Networking (Server Message Block, or SMB). The log-on actually an Internet Information Services log-on attempt, which I know only because the host does not respond on either Terminal Services or SMB across the Internet. The automated password grinders will typically try common user names, such as Administrator, with a dictionary of passwords. Shockingly, they must be successful enough with that approach to make it worthwhile to continue. Many people argue that you should rename the Administrator account to fool attackers, and some even say to create a decoy account called Administrator. This has absolutely no effect whatsoever. The error message is the same whether an account does not exist with the name Administrator or whether the attacker gets the password wrong. Therefore, from the attacker’s perspective, he cannot tell whether you have an account called Administrator. He can only tell that he did not get in. You can assure yourself that he will not get in simply by setting a reasonably strong password. For example, if the password is 15 characters long and seemingly random (meaning that it seems random from the attacker’s point of view) the attacker will have to try 542,086,379,860,909,058,354,552,242,176, or so, times before he succeeds. More than likely he will move on before he succeeds in guessing that password.
Source of Information : Microsoft Press Windows Server 2008 Security
How to protect and clean your PC
The most popular and typically the most effective way to rid your computer of malware is to use dedicated antivirus software and antispyware software. These programs rely on their own internal databases of known viruses, worms, Trojans, spyware, and adware, and as such, must be updated regularly (daily or weekly) to be able to detect and eliminate the latest threats.
Vista is the first operating system to include an antispyware tool, known as Windows Defender (found in Control Panel). The best part about it is that, left to its own devices, Windows Defender will regularly scan your system and even keep its spyware definitions up to date. But Vista still doesn’t come with an antivirus tool, mostly to appease the companies that make money selling aftermarket antivirus software (which is ironic, since the best tools are free). Following is a list of the more popular antivirus products.
Avast Home Edition (http://www.avast.com)
Freeware, with a slick interface and good feature set.
Avira AntiVir Classic (http://www.free-av.com)
Freeware, with frequent updates, but only average detection rates.
AVG Anti-Virus (http://free.grisoft.com)
Freeware, a popular yet poor-performing antivirus solution.
Kaspersky Antivirus Personal (http://www.kaspersky.com)
Very highly regarded solution with an excellent detection record.
McAfee VirusScan (http://www.mcafee.com)
Trusted and well-established all-around virus scanner with an intuitive interface and few limitations.
Panda Anti-Virus Titanium & Platinum (http://www.pandasecurity.com)
Lesser-known but capable antivirus software.
Symantec Norton AntiVirus (http://www.symantec.com)
Mediocre, slow antivirus software with a well-known name—but beware of its expensive subscription plan to keep virus definitions updated.
Antispyware software is a more complex field, and as a result, you’ll have the best luck using multiple tools in addition to Windows Defender. The top antispyware products include:
Ad-Aware Personal Edition (http://www.lavasoft.de)
Ad-Aware is one of the oldest antispyware tools around, but its definitions are still updated frequently. The personal edition is free and very slick, although it’s not usually as effective at removing spyware as Spybot or Spysweeper, both discussed next.
Spybot - Search & Destroy (http://www.spybot.info)
Not quite as nice to look at as Ad-Aware, Spybot excels at purging hard-to-remove spyware. And while both Ad-Aware and Spybot remove tracking cookies from Internet Explorer, Spybot supports Firefox as well.
Spy Sweeper (http://www.webroot.com)
This highly regarded antispyware tool, while not free like the first two, is still a welcome addition to any spyware-fighter’s toolbox, and can often remove malware that the others miss.
So, armed with proper antivirus and antispyware software, there are four things you should do to protect your computer from malware:
• Place a router between your computer and your Internet connection.
• Scan your system for viruses regularly, and don’t rely entirely on your antivirus program’s auto-protect feature. Run a full system scan at least every two weeks.
• Scan your system for spyware regularly, at least once or twice a month. Do it more often if you download and install a lot of software.
• See the the ways that malware spreads, and the for some of the things you can do to reduce your exposure to viruses, spyware, adware, and other malware.
Source of Information : OReilly Windows Vista Annoyances Tips Secrets and Hacks
Vista is the first operating system to include an antispyware tool, known as Windows Defender (found in Control Panel). The best part about it is that, left to its own devices, Windows Defender will regularly scan your system and even keep its spyware definitions up to date. But Vista still doesn’t come with an antivirus tool, mostly to appease the companies that make money selling aftermarket antivirus software (which is ironic, since the best tools are free). Following is a list of the more popular antivirus products.
Avast Home Edition (http://www.avast.com)
Freeware, with a slick interface and good feature set.
Avira AntiVir Classic (http://www.free-av.com)
Freeware, with frequent updates, but only average detection rates.
AVG Anti-Virus (http://free.grisoft.com)
Freeware, a popular yet poor-performing antivirus solution.
Kaspersky Antivirus Personal (http://www.kaspersky.com)
Very highly regarded solution with an excellent detection record.
McAfee VirusScan (http://www.mcafee.com)
Trusted and well-established all-around virus scanner with an intuitive interface and few limitations.
Panda Anti-Virus Titanium & Platinum (http://www.pandasecurity.com)
Lesser-known but capable antivirus software.
Symantec Norton AntiVirus (http://www.symantec.com)
Mediocre, slow antivirus software with a well-known name—but beware of its expensive subscription plan to keep virus definitions updated.
Antispyware software is a more complex field, and as a result, you’ll have the best luck using multiple tools in addition to Windows Defender. The top antispyware products include:
Ad-Aware Personal Edition (http://www.lavasoft.de)
Ad-Aware is one of the oldest antispyware tools around, but its definitions are still updated frequently. The personal edition is free and very slick, although it’s not usually as effective at removing spyware as Spybot or Spysweeper, both discussed next.
Spybot - Search & Destroy (http://www.spybot.info)
Not quite as nice to look at as Ad-Aware, Spybot excels at purging hard-to-remove spyware. And while both Ad-Aware and Spybot remove tracking cookies from Internet Explorer, Spybot supports Firefox as well.
Spy Sweeper (http://www.webroot.com)
This highly regarded antispyware tool, while not free like the first two, is still a welcome addition to any spyware-fighter’s toolbox, and can often remove malware that the others miss.
So, armed with proper antivirus and antispyware software, there are four things you should do to protect your computer from malware:
• Place a router between your computer and your Internet connection.
• Scan your system for viruses regularly, and don’t rely entirely on your antivirus program’s auto-protect feature. Run a full system scan at least every two weeks.
• Scan your system for spyware regularly, at least once or twice a month. Do it more often if you download and install a lot of software.
• See the the ways that malware spreads, and the for some of the things you can do to reduce your exposure to viruses, spyware, adware, and other malware.
Source of Information : OReilly Windows Vista Annoyances Tips Secrets and Hacks
Hackers and Crackers
A second threat on the Internet, though rare compared to viruses, are hackers and crackers. These are people (or more likely computers) that sneak stuff into your computer through open ports in your Internet connection. Hacking in real life isn’t at all like it is in movies. In movies, some good-looking young kids take two or three guesses at some password and magically have access to the entire computer. In real life, it doesn’t work that way at all. Nobody can break into your computer and steal things or even look around.
The kind of hacking that takes place on computers is almost always done by computers, not humans. Some human programmer creates a program that just wanders around the Internet looking for open ports, sneaking some virus-type program onto a computer’s hard disk without the owner knowing it. This is a slow and tedious way to infect multiple computers and therefore isn’t done much. But it is done, and you need to have some protection. The type of program you use to protect your computer from hackers is called a firewall. It actually works on a very simple principle. Normally, your computer will just accept anything that comes in off the Internet, under the assumption that if there’s something coming in from the Internet, you must have requested it. That’s the very assumption that enables hackers to sneak things onto your computer.
The press and the general public use the terms hacker and cracker interchangeably, despite the fact that doing so irritates the daylights out of computer programmers.
In the programming world, hacker is a slang term for programmer. The vast majority of programmers in the world never write any code that would damage a computer or replicate itself, and they don’t like being put in the same category as those who know just enough programming to take some existing virus and tweak it into something else (not at all impressive to a real programmer).
Programmers refer to people who do bad things with their programming skills as crackers, not hackers. Cracker has its origins in the idea of a safecracker, one who breaks into safes. But these programmers don’t break into safes. They break into computers and networks where they don’t belong, stealing corporate secrets or just wreaking random havoc.
Source of Information : Wiley Alan Simpsons Windows Vista Bible Desktop Edition
The kind of hacking that takes place on computers is almost always done by computers, not humans. Some human programmer creates a program that just wanders around the Internet looking for open ports, sneaking some virus-type program onto a computer’s hard disk without the owner knowing it. This is a slow and tedious way to infect multiple computers and therefore isn’t done much. But it is done, and you need to have some protection. The type of program you use to protect your computer from hackers is called a firewall. It actually works on a very simple principle. Normally, your computer will just accept anything that comes in off the Internet, under the assumption that if there’s something coming in from the Internet, you must have requested it. That’s the very assumption that enables hackers to sneak things onto your computer.
The press and the general public use the terms hacker and cracker interchangeably, despite the fact that doing so irritates the daylights out of computer programmers.
In the programming world, hacker is a slang term for programmer. The vast majority of programmers in the world never write any code that would damage a computer or replicate itself, and they don’t like being put in the same category as those who know just enough programming to take some existing virus and tweak it into something else (not at all impressive to a real programmer).
Programmers refer to people who do bad things with their programming skills as crackers, not hackers. Cracker has its origins in the idea of a safecracker, one who breaks into safes. But these programmers don’t break into safes. They break into computers and networks where they don’t belong, stealing corporate secrets or just wreaking random havoc.
Source of Information : Wiley Alan Simpsons Windows Vista Bible Desktop Edition
How malware spreads
Once they’ve infected a system, viruses and the like can be very difficult to remove. For that reason, your best defense against them is to prevent them from infecting your computer in the first place.
The most useful tool you can use to keep malware off your computer is your cerebral cortex. Just as malware is written to exploit vulnerabilities in computer systems, the distribution of malware exploits the stupidity of users. Malware is typically spread in the following ways:
Email attachments
One of the most common ways viruses make their way into computers is through spam. Attachments are embedded in these junk email messages and sent by the millions to every email address in existence, for unsuspecting recipients to click, open, and execute. But how can people be that dumb, you may ask? Well, consider the filename of a typical
Trojan horse:
kittens playing with yarn.jpg .scr
Since Windows has its filename extensions hidden by default this is how the file looks to most Vista users:
kittens playing with yarn.jpg
In other words, most people wouldn’t recognize that this is an .scr (screensaver) file and not a photo of kittens. (The long space in the filename ensures that it won’t be easy to spot, even if extensions are visible.)
And since many spam filters and antivirus programs block .exe files, but not .scr files—which just happen to be renamed .exe files—this innocuous-looking file is more than likely to spawn a nasty virus on someone’s computer with nothing more than an innocent double-click. So, how do you protect yourself from these? First, don’t open email attachments you weren’t expecting, and manually scan everything else with an up-to-date virus scanner. Next, employ a good, passive spam filter, and ask your ISP to filter out viruses on the server side.
Infected files
Viruses don’t just invade your computer and wreak havoc, they replicate themselves and bury copies of themselves in other files. This means that once your computer has been infected, the virus is likely sitting dormant in any of the applications and even personal documents stored on your hard disk. This not only means that you may be spreading the virus each time you email documents to others, but that others may be unwittingly sharing viruses with you.
One of the most common types of viruses involves macros, small scripts (programming code) embedded in documents. By some estimates, roughly three out of every four viruses is actually a macro written for Microsoft Word or Excel. These macros are executed automatically when the documents that contain them are opened, at which point they attach themselves to the global template so that they can infect every document you subsequently open and save. Both Word and Excel have security features that restrict this feature, but these measures are clumsy and most people disable them so they can work on the rest of their documents. In other words, don’t rely on the virus protection built in to Microsoft Office to eliminate the threat of these types of viruses.
Peer-to-peer (P2P) file sharing
Napster started the P2P file-sharing craze years ago, but modern file sharing goes far beyond the trading of harmless music files. It’s estimated that some 40% of the files available on these P2P networks contain viruses, Trojan horses, and other unwelcome guests, but even these aren’t necessarily the biggest cause of concern. To facilitate the exchange of files, these P2P programs open network ports and create gaping holes in your computer’s firewall, any of which can be exploited by a variety of worms and intruders. And since people typically leave these programs running all the time (whether they intend to or not), these security holes are constantly open for business. But wait...there’s more! If the constant threat of viruses and Trojan horses isn’t enough, many P2P programs themselves come with a broad assortment of spyware and adware, intentionally installed on your system along with the applications themselves. Kazaa, one of the most popular filesharing clients, is also the biggest perpetrator of this, and the likely culprit if your system has become infected with spyware. (Note that other products like Morpheus, BearShare, Imesh, and Limewire do this, too, just in case you were thinking there was a completely “safe” alternative.)
Web sites
It may sound like the rantings of a conspiracy theorist, but even the act of visiting some web sites can infect your PC with spyware and adware. Not that it can happen transparently, but many people just don’t recognize the red flags even when they’re staring them in the face. Specifically, these are the “add-ins” employed by some web sites that provide custom cursors, interactive menus, or other eye candy. While loading a web page, you may see a message asking if it’s OK to install some ActiveX gadget “necessary” to view the page (e.g., Comet Cursor); here, the answer is simple: no.
Network and Internet connections
Finally, your network connection (both to your LAN and to the Internet) can serve as a conduit for a worm, the special kind of virus that doesn’t need your help to infect your system. Obviously, the most effective way to protect your system is to unplug it from the network, but a slightly more realistic solution is to use a firewall. Vista comes with a built-in firewall, although a router provides much better protection.
Source of Information : OReilly Windows Vista Annoyances Tips Secrets and Hacks
The most useful tool you can use to keep malware off your computer is your cerebral cortex. Just as malware is written to exploit vulnerabilities in computer systems, the distribution of malware exploits the stupidity of users. Malware is typically spread in the following ways:
Email attachments
One of the most common ways viruses make their way into computers is through spam. Attachments are embedded in these junk email messages and sent by the millions to every email address in existence, for unsuspecting recipients to click, open, and execute. But how can people be that dumb, you may ask? Well, consider the filename of a typical
Trojan horse:
kittens playing with yarn.jpg .scr
Since Windows has its filename extensions hidden by default this is how the file looks to most Vista users:
kittens playing with yarn.jpg
In other words, most people wouldn’t recognize that this is an .scr (screensaver) file and not a photo of kittens. (The long space in the filename ensures that it won’t be easy to spot, even if extensions are visible.)
And since many spam filters and antivirus programs block .exe files, but not .scr files—which just happen to be renamed .exe files—this innocuous-looking file is more than likely to spawn a nasty virus on someone’s computer with nothing more than an innocent double-click. So, how do you protect yourself from these? First, don’t open email attachments you weren’t expecting, and manually scan everything else with an up-to-date virus scanner. Next, employ a good, passive spam filter, and ask your ISP to filter out viruses on the server side.
Infected files
Viruses don’t just invade your computer and wreak havoc, they replicate themselves and bury copies of themselves in other files. This means that once your computer has been infected, the virus is likely sitting dormant in any of the applications and even personal documents stored on your hard disk. This not only means that you may be spreading the virus each time you email documents to others, but that others may be unwittingly sharing viruses with you.
One of the most common types of viruses involves macros, small scripts (programming code) embedded in documents. By some estimates, roughly three out of every four viruses is actually a macro written for Microsoft Word or Excel. These macros are executed automatically when the documents that contain them are opened, at which point they attach themselves to the global template so that they can infect every document you subsequently open and save. Both Word and Excel have security features that restrict this feature, but these measures are clumsy and most people disable them so they can work on the rest of their documents. In other words, don’t rely on the virus protection built in to Microsoft Office to eliminate the threat of these types of viruses.
Peer-to-peer (P2P) file sharing
Napster started the P2P file-sharing craze years ago, but modern file sharing goes far beyond the trading of harmless music files. It’s estimated that some 40% of the files available on these P2P networks contain viruses, Trojan horses, and other unwelcome guests, but even these aren’t necessarily the biggest cause of concern. To facilitate the exchange of files, these P2P programs open network ports and create gaping holes in your computer’s firewall, any of which can be exploited by a variety of worms and intruders. And since people typically leave these programs running all the time (whether they intend to or not), these security holes are constantly open for business. But wait...there’s more! If the constant threat of viruses and Trojan horses isn’t enough, many P2P programs themselves come with a broad assortment of spyware and adware, intentionally installed on your system along with the applications themselves. Kazaa, one of the most popular filesharing clients, is also the biggest perpetrator of this, and the likely culprit if your system has become infected with spyware. (Note that other products like Morpheus, BearShare, Imesh, and Limewire do this, too, just in case you were thinking there was a completely “safe” alternative.)
Web sites
It may sound like the rantings of a conspiracy theorist, but even the act of visiting some web sites can infect your PC with spyware and adware. Not that it can happen transparently, but many people just don’t recognize the red flags even when they’re staring them in the face. Specifically, these are the “add-ins” employed by some web sites that provide custom cursors, interactive menus, or other eye candy. While loading a web page, you may see a message asking if it’s OK to install some ActiveX gadget “necessary” to view the page (e.g., Comet Cursor); here, the answer is simple: no.
Network and Internet connections
Finally, your network connection (both to your LAN and to the Internet) can serve as a conduit for a worm, the special kind of virus that doesn’t need your help to infect your system. Obviously, the most effective way to protect your system is to unplug it from the network, but a slightly more realistic solution is to use a firewall. Vista comes with a built-in firewall, although a router provides much better protection.
Source of Information : OReilly Windows Vista Annoyances Tips Secrets and Hacks
What is Viruses, Malware, and Spyware
Malware, or malicious software, is a class of software designed specifically to wreak havoc on a computer—your computer. Malware includes such nasty entities as viruses, Trojan horses, worms, and spyware. If you’re experiencing frequent crashing, nonsensical error messages, pop-up advertisements (other than when surfing the Web), or slower-than-normal performance, the culprit may be one of the following types of malware (as opposed to a feature authored by Microsoft):
Viruses
A virus is a program or piece of code that “infects” other software by embedding a copy of itself in one or more executable files. When the software runs, so does the embedded virus, thus propagating the “infection.” Viruses can replicate themselves, and some (known as polymorphic viruses) can even change their virus signatures each time to avoid detection by antivirus software. Unlike worms, defined next, viruses can’t infect other computers without assistance from people. One particular type of virus, a Trojan horse, spreads itself by masquerading as a benign application (as opposed to infecting an otherwise valid file), such as a screensaver or even, ironically, a virus removal tool.
Worms
A worm* is a special type of virus that can infect a computer without any help from its user, typically through a network or Internet connection. Worms can replicate themselves like ordinary viruses, but do not spread by infecting programs or documents. A classic example is the W32.Blaster.Worm, which exploited a bug in Windows XP, causing it to restart repeatedly or simply seize up.
Spyware and adware
Spyware is a little different than the aforementioned viruses and worms, in that its purpose is not necessarily to hobble a computer or destroy data, but rather something much more insidious. Spyware is designed to install itself transparently on your system, spy on you, and then send the data it collects back to an Internet server. This is sometimes done to collect information about unsuspecting users, but most often to serve as a conduit for pop-up advertisements (known as adware).
Aside from the ethical implications, spyware can be particularly troublesome because it’s so often very poorly written, and as a result, ends up causing error messages, performance slowdowns, and seemingly random crashing. Plus, it uses your computer’s CPU cycles and Internet connection bandwidth to accomplish its goals, leaving fewer resources available for the applications you actually want to use.
Now, it’s often difficult to tell one type of malicious program from another, and in some ways, it doesn’t matter. But if you understand how these programs work—how they get into your computer, and what they do once they’ve taken root—you can eliminate them and keep them from coming back.
Source of Information : OReilly Windows Vista Annoyances Tips Secrets and Hacks
Viruses
A virus is a program or piece of code that “infects” other software by embedding a copy of itself in one or more executable files. When the software runs, so does the embedded virus, thus propagating the “infection.” Viruses can replicate themselves, and some (known as polymorphic viruses) can even change their virus signatures each time to avoid detection by antivirus software. Unlike worms, defined next, viruses can’t infect other computers without assistance from people. One particular type of virus, a Trojan horse, spreads itself by masquerading as a benign application (as opposed to infecting an otherwise valid file), such as a screensaver or even, ironically, a virus removal tool.
Worms
A worm* is a special type of virus that can infect a computer without any help from its user, typically through a network or Internet connection. Worms can replicate themselves like ordinary viruses, but do not spread by infecting programs or documents. A classic example is the W32.Blaster.Worm, which exploited a bug in Windows XP, causing it to restart repeatedly or simply seize up.
Spyware and adware
Spyware is a little different than the aforementioned viruses and worms, in that its purpose is not necessarily to hobble a computer or destroy data, but rather something much more insidious. Spyware is designed to install itself transparently on your system, spy on you, and then send the data it collects back to an Internet server. This is sometimes done to collect information about unsuspecting users, but most often to serve as a conduit for pop-up advertisements (known as adware).
Aside from the ethical implications, spyware can be particularly troublesome because it’s so often very poorly written, and as a result, ends up causing error messages, performance slowdowns, and seemingly random crashing. Plus, it uses your computer’s CPU cycles and Internet connection bandwidth to accomplish its goals, leaving fewer resources available for the applications you actually want to use.
Now, it’s often difficult to tell one type of malicious program from another, and in some ways, it doesn’t matter. But if you understand how these programs work—how they get into your computer, and what they do once they’ve taken root—you can eliminate them and keep them from coming back.
Source of Information : OReilly Windows Vista Annoyances Tips Secrets and Hacks
Subscribe to:
Posts (Atom)