Intro to Wireless Security

Change the System ID: Devices come with a default system ID called the SSID (Service Set Identifier) or ESSID (Extended Service Set Identifier). It is easy for a hacker to find out what the default identifier is for each manufacturer of wireless equipment so you need to change this to something else. Use something unique- not your name or something easily guessed. Disable Identifier Broadcasting: Announcing that you have a wireless connection to the world is an invitation for hackers. You already know you have one so you don’t need to broadcast it. Check the manual for your hardware and figure out how to disable broadcasting. Enable Encryption: WEP (Wired Equivalent Privacy) and WPA (Wi-Fi Protected Access) encrypt your data so that only the intended recipient is supposed to be able to read it. WEP has many holes and is easily cracked. 128-bit keys impact performance slightly without a significant increase in security so 40-bit (or 64-bit on some equipment) encryption is just as well. As with all security measures there are ways around it, but by using encryption you will keep the casual hackers out of your systems. If possible, you should use WPA encryption (most older equipment can be upgraded to be WPA compatible). WPA fixes the security flaws in WEP but it is still subject to DOS (denial-of-service) attacks. Restrict Unnecessary Traffic: Many wired and wireless routers have built-in firewalls. They are not the most technically advanced firewalls, but they help create one more line of defense. Read the manual for your hardware and learn how to configure your router to only allow incoming or outgoing traffic that you have approved. Change the Default Administrator Password: This is just good practice for ALL hardware and software. The default passwords are easily obtained and because so many people don’t bother to take the simple step of changing them they are usually what hackers try first. Make sure you change the default password on your wireless router / access point to something that is not easily guessed like your last name. Patch and Protect Your PC’s: As a last line of defense you should have personal firewall software such as Zone Alarm Pro and anti-virus software installed on your computer. As important as installing the anti-virus software, you must keep it up to date. New viruses are discovered daily and anti-virus software vendors generally release updates at least once a week. You also must keep up to date with patches for known security vulnerabilities. For Microsoft operating systems you can use Windows Update to try and help keep you current with patches. if(zSbL

View the original article here

Wireless Security FAQ Complex

The wireless router has becoming such as common household appliance that most people forget its even there. These devices have become so easy to setup that many of us don't bother to even change the default settings or configure the wireless security features.

Leaving your wireless router unsecured can not only leave your network open to attack, it can also subject your network to leeching neighbors who will eat away the precious bandwidth that you pay your hard earned money for.

Securing your Wireless Router can be tricky. Here are some frequently asked questions and answers to help you choose and lock down a wireless router or access point:

1. Is my Wireless Network Safe if my Wireless Router has WEP Security Turned on?

Answer: No. While Wired Equivalent Privacy (WEP) was an excellent wireless encryption standard a few years ago, it does not provide the same level of protection as newer standards such as Wi-Fi Protected Access (WPA). WEP has been cracked and can be easily circumvented by hackers using tools that are freely available on the Internet.

2. What Security Features Should I Look for When Buying a Wireless Router?

Answer: Make sure any wireless router or access point you buy supports the latest wireless encryption standards such as WPA/WPA2. Other features to look for include: Built-in firewall Media Access Control (MAC) address filtering capability Remote administration lockout feature The ability to disable Service Set Identifier (SSID) broadcasting Access time limit control Parental control Restricted “guest” network zoning 3. How do I keep Neighbors From Leeching off of my Wireless Internet Connection?

Answer: The best way to keep people from freeloading off of your wireless connection is to: Enable WPA2 encryption on your wireless router or access point and set a strong password that is not easily guessed Change the SSID (wireless network name) to something other than the default value set by the manufacturer Turn off the “Broadcast SSID” feature of your router or access point so that only those who know what the network’s name is can access it 4. How Can I Keep my Kids From Using Wi-Fi on Their iPod/DS to Access the Internet?

Answer: Kids will be kids. They are very tech-savvy and will do everything they can to circumvent any security barriers you put up. Here are a few actions you can take to make it as difficult as possible for them: Use WPA2 encryption on your router with a strong password and don’t give them the password Change your wireless router’s default administration password Disable your wireless router’s remote administration feature Locate the wireless router in your bedroom or a locked closet to prevent them from pressing the factory settings reset button Enable the parental control features of their game device or iPod Enable MAC address filtering on your wireless router and exclude the MAC address of their device(s) from those allowed access Enable the access time restrictions feature of your wireless router and limit Internet access to daytime hours only 5. Is it legal to use my neighbor’s wireless hotspot if he left it unsecured?

Answer: Is it legal for you to go in your neighbor’s house if he left the door unlocked? No, it is not legal. The same applies to his wireless access point.

View the original article here

Top 100 Security Tools

In 2000, Fyodor, creator of the NMap Scanner, conducted a survey of the readers of the nmap-hackers mailing list and compiled the Top 50 Security Tools.

Three years later, Fyodor again conducted the survey, and expanded the list to include the Top 75 Security Tools. Another three years have gone by and another survey has been done. With 3,243 readers responding, Fyodor has compiled the Top 100 Security Tools from his 2006 survey and they are now posted on the Insecure.org web site.

There are a total of 42 new tools on the list. That means that 42 out of 100 tools on the Top 100 Security Tools list did not appear on the 2003 Top 75. Thirteen of the new tools even made the top 50. Had the list been maintained at the Top 75, the length of the list in 2003, 27 of the tools (almost half) would be new to the list.

For the complete, detailed listing of all 100 tools, complete with links to download them, you should visit the Top 100 Security Tools listing on Insecure.org. I will summarize here the top 10, as well as providing a list of the new tools on the list. Nessus (vulnerability scanners) Wireshark (packet sniffers- previously known as Ethereal) Snort (IDS - intrusion detection system) Netcat (Netcat) Metasploit Framework (vulnerability exploitation tools) HPing2 (packet crafting tools) Kismet (wireless tools or packet sniffers) TCPDump {packet sniffers) Cain and Abel (password crackers or packet sniffers) John The Ripper (password crackers) Metasploit Framework Paros Proxy Aircrack Sysinternals Scapy BackTrack P0f Google WebScarab WebInspect Core Impact IDA Pro Rainbow Crack AngryIP Scanner RKHunter Ike-scan KisMAC OSSEC HIDS Tor Knoppix chrootkit Yersinia Nagios X-scan Socat QualysGuard ClamAV BurpSuite Unicornscan BASE Argus Wikto SGuil IP Filter Canvas VMware OpenVPN OllyDbg Helix Acunetix Web Vulnerability Scanner TrueCrypt Watchfire AppScan

View the original article here

Google+ Security

You've heard all the hype about Google+. You may have even dived in, gotten yourself an account, and started building your "circles" of friends, but have you taken the time to see what kind of privacy and security features that Google has baked into Google+?

Facebook, Google+'s main competitor, has adapted its privacy and security settings over time, based on its user's concerns and other factors. Facebook has achieved a fairly robust system of opt-in, opt-out, group, and friend-based security and privacy measures that are still evolving today.

It's ultimately up to the Google+ developers as to whether they want to follow Facebook's lead or go in a completely different direction with regards to security and privacy features.

The jury is still out on whether or not Google+ has done a good job implementing its privacy and security features. We all remember Google's first major foray into the world of social networking, also known as Google Buzz. Buzz's initial privacy settings left a lot to be desired and a class action lawsuit was filed as a result. Has Google learned it's lesson? We'll have to wait and see.

Here are some tips on how you can use Google+'s currently offered security and privacy options to make your Google+ experience a safe one.

To begin, click on the gear icon in the top-right corner of your Google+ home page.

1. Restrict the visibility of your Google+ circles to increase your privacy

Unless you want everyone in the world to be able to see who your friends are, you'll probably want to limit access to this information.

To restrict who can see your friends and circles:

Click the "Profile and Privacy" link from the "Google+ Accounts" page:

Click the "Edit Network Visibility" button from the "Sharing" section of the page..

Uncheck the box for "Show People In" if you don't want anyone, including those in your circles, to be able to see who your friends are. Your other option is to leave the box checked, and choose whether you want your friends to be able to see who is in your circles, or you can allow the whole world to see this information. The current default is to allow everyone in the world to see who are in your circles.

If you want to be extra private you can prevent the fact that you have been added to other people's circles by unchecking the box that says "Show people who have added you to circles" at the bottom of the "Edit Network Visibility" pop-up box.

2. Remove global access to the parts of your personal profile that you don't want to share with the world

Identity thieves love personal details such as where you went to school, where you have worked, etc. These details are a gold mine for them. If you make these tidbits of information available for the whole world to see, you are just asking for them to use them to steal your identity. It's best to restrict access to most of these details, allowing only your friends the ability to see this information.

Anytime you see a globe icon next to something in Google+ it means that you are sharing that item with the world and not just with those within your circles.

To restrict certain parts of your profile to only be visible to people within your circles:

Click the "Profile and Privacy" link from the "Google+ Accounts" page.

Click the "Edit visibility on profile" link under the "Google Profiles" section of the page.

On the page that opens, click each item in your profile to modify its visibility settings. Click the drop-down box and change the items that you don't want revealed to the world.

Click the "Done Editing" button in the red bar near the top of the screen when you are finished modifying your profile visibility.

If you don't want your information made available to search engines, you should uncheck the "Help others find my profile in search results" box from the "Search visibility" section at the bottom of the page.

3. Restrict visibility of individual posts in your Google+ stream

Google+ allows you to restrict visibility of individual posts (i.e. status updates, photos, videos, links, etc...). When you're posting something in your Google+ stream on your homepage, look at the box underneath the text box you are typing your post into. You should see a blue box with the name of your default circle (i.e. Friends). This indicates the people that your post is about to be shared with. You can remove visibility for the post by clicking the "X" icon inside the blue box. You can also add or remove an individual's or circle's ability to see the post.

As Google+ evolves, it will undoubtedly feature additional privacy and security options. You should check the "Profile and Privacy" section of your Google+ account every month or so to make sure that you haven't been opted-in to something you would have rather been opted-out of.

View the original article here

Siri Security

If you're lucky enough to have landed a new iPhone 4S, then chances are you have been playing around with the new Siri virtual assistant. You've probably been asking it all sorts of important questions like "What's the meaning of life?", or "why do my Shi Tzu dogs keep treating the cat's litter box like it's an all you can eat buffet?"

As Siri's knowledge and user base grows, there may be potential security issues. I don't think that Siri is going turn into Skynet from the Terminator movies or anything, but there are likely hackers out there who are already working on how to hack Siri and exploit any newly discovered Siri-related vulnerabilities they find.

Fortunately the hackers don't have to work very hard because it appears that there is already a potential Siri-reared security risk that is present on your iPhone 4S with it's out-of-the-box default configuration settings.

Apple has decided that users would prefer quick access over device security for the Siri feature which is why that it's default settings have been set to allow Siri to bypass the passcode lock. This makes sense for Apple as they are all about creating a great user experience. Unfortunately, allowing the Siri feature to bypass the passcode lock has the consequence of providing a thief or hacker with the ability to make phone calls, send texts, send e-mails, and access other personal information without having to enter the security code first.

There is always a balance that must be struck between security and usability. Users and software developers must make the choice on how much perceived security feature-related inconvenience they are willing to endure to keep their devices safe versus how quickly and easily they want to be able to use them.

Some people use a iPhone lock screen with a simple 4-digit code while some opt for a more complex iPhone passcode. Other people have no passcode at all because they want instant access to their phone. It's a user choice based on individual risk tolerance.

To block Siri from being able to bypass the screen lock passcode perform the following:

1. Tap on the "Settings" icon from the home screen (Grey icon with gears in it)

2. From the "Settings" menu, tap the "General" option.

3. Choose the "Passcode lock" option in the "General" menu.

4. Turn the "Allow access to Siri when locked with a passcode" option to the "OFF" position.

5. Close the "Settings" menu.

Again, whether you prefer instant access to Siri without the need to have to look at the screen to enter a passcode is completely up to you. In some cases, while you're in the car for instance, driving safetly would trump data security. So if you use your iPhone in hands-free mode a lot, then you would probably want to keep the default option, allowing the Siri passcode bypass.

As the Siri feature becomes further advanced and the amount of data sources she is tapped into increases, the data security risk for the screen lock bypass may also increase. For example, if developers tie Siri into their apps in the future, Siri could unwittingly provide a hacker with your financial information if a Siri-enabled banking app is running and logged in via cached credentials and a hacker asks Siri the right questions.

Brace yourselves folks, as this technology improves and becomes more widespread, a whole new category of virtual assistant social engineering hacks and attacks will be born.

View the original article here