security Archives

Home » security » Page 58

End of the innocence for Mac security

Dave Farquhar Macintosh, security March 30, 2012Adobe Acrobat, Adobe Reader, antivirus, apple, firefox, mac os x, macintosh, malicious code, malware, Malware Domains, microsoft word, office 2007, os x, pdf files, spyware, trojan horse, vector, vulnerability, yahoo

Antivirus vendor Kapersky has identified a new trojan horse targetting Macintoshes. It spreads a botnet based somewhere in China via an infected Microsoft Word document, typically sent as an e-mail attachment.

The spin is that if you don’t use Word on your Mac, you’re safe. That’s true–this week. But going forward, it’s going to take more than that. Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.

dfarq.homeip.net

Securing wi-fi isn’t about price gouging

Dave Farquhar security March 28, 2012October 11, 20191990s, firewall, john c dvorak, Love Letter, malware, Missouri, New Madrid Fault, spam, WEP, wi-fi

The so-called wi-fi golden era is over, and apparently being glad about it makes me an absolutist.

But John C. Dvorak is wrong. This isn’t about making people pay for Internet access. It’s pure security. Toilets and drinking fountains are free because the majority of people don’t abuse them. The Internet can’t be wide open and free like a public restroom because when it was totally wide open and free in the 1990s, too many people abused it. Read more

Dave Farquhar

dfarq.homeip.net

Don’t give prospective employers your Facebook password

Dave Farquhar security March 22, 2012computer security, passwords

I’ve read multiple stories this week about potential employers demanding that interviewees hand over their Facebook passwords during the job interview so they can snoop around.

There’s no good reason for this.
Read more

Dave Farquhar

dfarq.homeip.net

There’s a 61% chance the Adobe software you run at work is out of date

Dave Farquhar security March 17, 2012April 16, 2017Adobe Reader, command prompt, firewall, oracle, pdf files, toolkits, webshots

I read this week that 61% of Adobe Reader installations in workplaces is out of date.

That’s very bad. Very, very bad. Because Adobe Reader is trivially easy to exploit, and there’s more sensitive information to steal on corporate PCs than there is on home PCs.

Dave Farquhar

dfarq.homeip.net

Apply your monthly patches just as soon as you can

Dave Farquhar security, Windows March 14, 2012excel, malware, net view, Patch Tuesday, SQL, terminal server, vulnerability

There are only six patches in this month’s edition of Patch Tuesday, and only one of them is critical, but it’s a big one.

The critical patch fixes a flaw in Remote Desktop Protocol, something typically only present in the business-oriented flavors of Windows. But if you don’t know whether you’re affected, it behooves you to let Windows update whatever it wants to update. Read more

Dave Farquhar

dfarq.homeip.net

Unix-to-Windows copies with PSCP

Dave Farquhar Linux, security, Windows March 12, 2012firewall, JPG, PNG, SQL, SSH, unix

I’ve been moving files between Linux servers, and to and from Windows boxes, as part of my server migration. I started to write about how I’ve been doing it, but it seemed oddly familiar.

Yep, I’ve written about SCP and its Windows port, PSCP, before. Do this long enough and you find yourself repeating yourself.

Dave Farquhar

dfarq.homeip.net

The old days of viruses

Dave Farquhar security, Viruses March 8, 2012August 12, 2018antivirus, CIO, CISM, cissp, computer security, firewall, intel, John Dominik, journalism, Love Letter, malware, Missouri, public internet, spam, symantec, university of missouri, VBS

Blogging pioneer John Dominik, inspired by my Michelangelo memories, wrote about his memories of viruses later in the decade. So now I’ll take inspiration of him and share my memories of some of those viruses. I searched my archives, and at the time it was going on, I didn’t write a lot. I was tired and angry, as you can tell from the terse posts I did write.

Dave Farquhar

dfarq.homeip.net

Remembering Michelangelo

Dave Farquhar security March 7, 20121990s, amiga, boot floppies, certifications, IBM, macintosh, malware, MBR, McAfee

Yesterday was the 20th anniversary of the Michelangelo virus. If you don’t remember, on March 6, 1992, Michelangelo was programmed to overwrite the first 100 sectors of a hard drive–not quite as destructive as formatting a drive, but to the average user, the effect is the same. It was a huge scare–John McAfee predicted five million computers would be affected–but largely was a non-event.

Those of you studying for security certifications would do well to remember that Michelangelo is a prime example of a virus and a logic bomb. Viruses replicate; logic bombs do something when an event triggers. Malware doesn’t always fit neatly into specific categories–crossovers are common.
Read more

Dave Farquhar

dfarq.homeip.net

Don’t use Password1 as your password

Dave Farquhar security March 2, 2012passwords, Two-factor authentication

CNN reported yesterday that Password1 is the most common password in business environments. It’s the simplest password that meets common “complexity” requirements. It illustrates the problem with complexity requirements–a password can meet those requirements while still being extremely predictable.

As such, those passwords can be easy to guess, and they cast doubt on the entire idea of complexity.

Dave Farquhar

dfarq.homeip.net

A cloud computing-related Security+ question

Dave Farquhar security February 29, 2012August 12, 2018CISM, cissp, datacenter, DBA, SSCP

Someone tossed a Security+ study question my way this week. This is an example of Security+ trying to be CISSP Lite, but it’s still a valid question–probably for either test, and for SSCP and CISM too.

A small not-for-profit organization needs to invest in a new expensive database. There is no budget for additional servers or personnel. Which of the following solutions would allow it to save money by avoiding hiring additional personnel and minimize the footprint in their current datacenter?
A. Linux
B. Software as a Service (SaaS)
C. Infrastructure as a Service (IaaS)
D. Platform as a Service (PaaS)

Let’s take it one at a time.

Dave Farquhar

dfarq.homeip.net