Bryans Blog

QR Tags – Cybercrime Hack

Adapted from Fox News

You’ve probably seen QR tags thousands of times, from advertisements on the bus to coupon flyers in the mail to products in the supermarket. They look like stamp-size bar codes, a grid of small black-and-white rectangles and squares, usually with bigger black squares in the corners.

A marketer’s dream-come-true, these tiny images are capable of storing and transmitting loads of data directly to the smartphones of interested customers. When a person scans a QR tag with a smartphone, the tag can do any number of things, including taking the user right to the product’s website.

But like any technology, they can also be manipulated to bite the hands — or phones — that feed them. On the mobile security blog Kaotico Neutral, researcher Augusto Pereyra demonstrated how these innocuous QR tags can be made into cybercrime weapons.

In his proof-of-concept hack, Pereyra took a QR tag he created from a free online tag creator and embedded in it the URL for an attack server called evilsite.dyndns.org. When the target smartphone scanned the tag, the browser was directed to the spoofed site and fed malware.

QR tags are touted for their convenience, but it’s that same convenience — coupled with their increasing prevalence — that Pereyra believes could allow them to become dangerous attack vectors. Popular QR tag-scanning software, such as ScanLife, automatically takes mobile browsers to the site embedded within the tag, and while it makes the process quick, it does nothing for its safety.

"This is a serious problem since this is the equivalent of clicking a link with your eyes closed," Pereyra wrote.

Tim Armstrong, researcher for the security firm Kaspersky Lab, said this streamlined process creates a "run first, ask questions later" mentality that benefits attackers.

An attack like his could easily be scaled up, Pereyra said, simply by printing the rigged QR tags and pasting them atop already-existing tags on posters in public places.

As companies and marketers take advantage of the power and ubiquity of mobile devices, and it becomes easier for consumers to carry out financial transactions via smartphones, researchers suspect online attackers will attempt to gain their own foothold in the market.

If you have any system questions or concerns, contact the CCS Retail Systems Support Department at 800-672-4806 or email us

-Bryan

What is phishing? 

I know most have heard the term before, but what is it really?  A quick search comes up with this definition.

The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the users information.

I bring this up because recently, I had a customer forward me some emails from their bank that were claiming that the account may have been compromised.  There are many ways for bad guys to get your account information. One way is a keylogger.  A key logger tracks and sends every keystroke that is made and sends the resulting file to the bad guys. 

After thoroughly check the PC for any malicious software, it was determined that the PC was clean. After talking about the issue more deeply with the customer, it was also determined that they may have been "phished" unknowingly.  If you ever receive and email from a financial institution, the IRS, or any website you have an account with that asks to verify or confirm your information, immediately delete the email, and contact the website.  Do not click on any links within the email.  Open your browser and manually type in the address to get the contact info.  This is another reason why you should not use the same username/password combination for all of your accounts.  Once the bad guys have your information they will try anything to get more.

If you have any system concerns or questions, contact the CCS Retail Systems Support Department at 800-672-4806 or email us.

-Bryan

How To Manage Infrastructure Changes – An Example

A couple of weeks ago I received a call from the owner of one of our customer’s locations.  He wanted to touch base about a pending Internet circuit switch to a faster speed which would require an IP address change.  He had the date when the ISP would be coming in to switch out their equipment, so we scheduled a time for me to be available for any help that may be needed.

It was critical that business was not interrupted, so I suggested that the switch be done after closing time, to which he agreed.  I also asked for him to keep me in the loop with all of the scheduling on the ISP/Phone Co. side in case there were any changes.

On the scheduled day I phoned my specified contact to confirm the appointment and asked that before anything gets switch over or off to give me a call so I can make the necessary changes to the companies equipment.  At the time specified, I received a call from the ISP’s tech to inform me he was ready for me to make my changes.  I logged in remotely to their system, made my changes, the ISP tech made his changes and with in a few seconds they were switched over to the new circuit, Internet access was tested, questions were answered and it was done.  Normal business was unaffected by any changes made, the owner was happy with the speed and relative easy it was to switch. The users saw a seamless change.

In contrast, if none of the planning is done, this could of been a nightmare for the business.  It could of lost thousands of dollars by not having access to the Internet to research or order parts, or authorize credit card transactions.

The owner did everything correctly. 

• He gave plenty of advanced notice of when and what was going to change.

• He scheduled a time for CCS to be available instead of calling at the last minute to say "Nothings Working"

• He specified a single point of contact that was aware and informed of what was taking place

Those 3 things alone made the work that needed to be done a 15 minute support call verses a possible on-site 2 hour support call.  And a problem where the left hand did not know what the right hand was doing.

If you have any system questions or concerns, call the CCS Retail Support Department at 800-672-4806 or email us.

-Bryan

Preventing A Computer Meltdown.

Well its Summer time again, or at least that’s what they are saying, so what does that mean?  Time to clean out your PC of dust bunnies. With the warmer temperatures, your computer will run a little warmer.  Dust can clog the fan and  ventilation flow,  this can amplify the impact of higher external temperature on the internal components.   Any electronic device has an operating temperature range.   If this is exceeded, what it does is undefined.   It just gets lost and hangs or crashes.

An example of what can happen reminds me of a support call I recently received.  The PC in question is used remotely, by a user not in the office.  The PC does not have a monitor attached to it.  The user tried logging into the PC and could not.  It was shutdown due to an overheating condition.  Unfortunately, the overheating was a little too much for this older PC.  We could save the CPU but not other parts of the motherboard..  Imagine if this were a Server. Not a pretty picture if you ask me.

This PC could have had a longer life if it was cleaned out of dust bunnies with compressed air at least once.  From what I was told, this was never done.  All it takes is about 10 minutes and a can of compressed air to help your PC last through summer no matter where you reside. Remember, do not use a vacuum it could suck up important pieces like jumper covers that you may never know existed.  Definitely do not use an air compressor.  The condensation that builds up could cause other electrical issues.

I remember an incident that another tech experienced with a customer who owned a factory.   The customer decided to save time on cleaning his server.   He took the case off and walked into the factory to use the air hose that cleans motors.  There was a loud air flow sound.  He came back pleased with himself and put the case back on.  When he hit the power button nothing happened.   He had blown several jumpers off on the factory floor.  We had no idea what was missing,, where they had landed, and how to add the jumpers back.   It was an old clone with limited documentation.   Don’t repeat that mistake at you premise.

If you need help cleaning your PC, give the CCS Retail Support Department a call at 800-672-4806 or email us for an appointment.

-Bryan

My last blog was about an easy way to create a complex password.  Todays blog will show you why it is important to use complex passwords especially in a business environment.

I recently read an article about how long it can take to "hack" passwords. Although there are many ways a hacker can use, the most common is what is called a brute force attack, this is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. By the way, this software is free so dont think it has to be some elite hackers, it can be your 14 year old next door neighbor.

The more complex your password the longer it would take to "crack" or guess your password.  There are three main things that determine how long it would take.

1. Length and Complexity of your passwor

2. The speed of the hackers computer

3. The speed of the hackers Internet connection

Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it’s just a matter of time before the computer runs through all the possibilities – or gets shut down trying.
 
Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters – like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.
 

Password Length	All Characters	Only Lower Case
3	0.86 seconds	0.02 seconds
4	1.36 minutes	.046 seconds
5	2.15 hours	11.9 seconds
6	8.51 days	5.15 minutes
7	2.21 years	2.23 hours
8	2.10 centuries	2.42 days
9	20 millennia	2.07 months
10	1,899 millennia	4.48 years
11	180,365 millennia	1.16 centuries
12	17,184,705 millennia	3.03 millennia
13	1,627,797,068 millennia	78.7 millennia

Remember, these are just for an average computer, and these assume you aren’t using any word in the dictionary. If Google put their computer to work on it they’d finish about 1,000 times faster.

Most hackers are not going to spend years or centuries or even days trying to crack a password, they are trying for the quick ones. So the more complex it is more likely they will skip it.

If you have any system questions or concerns call the CCS Retail Support Department at 800-672-4806 or email us

-Bryan

 

Using Complex Passwords

More and more websites and software applications are now requireing you to use a complex password.  Complex meaning at least 7 characters long, using upper and lower case letters, and some even requiring that at least 1 number is used.

Like you, Im not a big fan of having to come up with some long password Ill probably forget tomorrow.  But I have found and easy way for you to come up with that password with the help of Microsoft. I’ve just read that Microsoft’s Hotmail email service is no longer going to allow "easy" or "common" passwords like "1234" or "password" to log into your account, and will make you change it.

Here is what they recommend to help you come up with a "complex" password. 

Steps	Suggestion	Example
Start with a sentence or 2 (about 10 words)	Think of something meaningful to you	Long and complex passwords are safest
Turn your sentence into a row of letters	use the first letter of each word	lacpas
add complexity	Make only the first half of the alphebet uppercase	lACpAs
add legnth with numbers	add 2 numbers that have meaning to you	lAC89pAs
add legnth with punctuation	put a punctuation mark at the beginning	?lAC89pAs
add legnth with symbols	put a symbol at the end	?lAC89pAs"

There, we now have a 10 character complex password using upper and lower case letters, punctuation, and symbols that has meaning to you so you can remember and be hard for someone to guess.

Although my chart is not exactly like was shown, I think you can get the picture here.  A link to the article can be found here.

It also has a "Password checker" to see if your password is strong enough.

As an alternative you may want to consider a password generator and keeper program such as Keepass.  These can help automate generation of several types of complex passwords and remember them for you.

If you have any system questions or concerns, contact the CCS Retail Systems Supprt Department at 800-672-4806 or email us

-Bryan

 

Unusual Outlook 2010 Problem

I recently received a call from a customer who updated their Office software with the recently released Service Pack 1.  After the install, when ever they tried to open Outlook, the splash screen would pop up, the application seemed to start and the Outlook icon would appear on the taskbar but could not be maximized, only closed.  Looking in the event log I saw references to problems with the "crawl scope" – a Microsoft term related to some of their search technology.

Now I have seen some weird stuff as the years rolled by but this problem might be one of the weirdest and the fix was even stranger.

After researching the issue on the web, I found there were a few people with the same problem.  All the advise offered to fix the issue did not work.  I then decided to try something that I didn’t think would make any difference but sometimes with problems like this you never know.

I opened the properties windows of the Outlook Icon in the start menu, (not the shortcut on the desktop although this may have worked also), and I checked the option to "Run as Administrator".  I saved my changes, and tried to open Outlook.  To my delight, it opened normally.  I was not sure that was the solution but it was an educated guess.  I went ahead and closed the application, reversed my changes, and tried again.  It opened normally, and the application worked.

You ask why would something so simple as running an application as "Administrator" fix the problem?  Well with Windows 7 and Vista, even though your normal user may be part of the Administrators group, sometimes Windows needs the actual Administrator user to make changes to the registry keys or shared files that your normal user can not access.  That’s what I think fixed the issue. 

I try not to question why Windows works the way it does.  It was great that I was able to fix the problem.  Perhpas the SP1 script that Microsoft created was not intended to work this way and this was an oversight.  Perhaps this could have been avoided if the script had a run as administrator option prompt built-in.  Maybe Microsoft could consider this on future service packs.

As always, if you have any system questions or concerns call the CCS Retail Support Department at 800-672-4806 or email us.

-Bryan

 

Popureb Trojan

Microsoft is telling Windows users that if they get infected with a new rootkit that hides in the boot sector, that they will have to re-install Windows.

A new variant of a Trojan Microsoft calls "Popureb" digs itself so deeply into the system that the only way to remove it is to return Windows back to its "Out Of The Box" configuration.

"If your system gets infected with this trojan, we advise you to fix the MBR (Master Boot Record) and the use a recovery CD to restore your system to a pre-infected state" said a Microsoft engineer with the Microsoft Malware Protection Center.

Malware like Popureb overwrites the hard drives MBR, the first sector where code is stored that helps your computer start up.  Because it hides here, the rootkit is effectively invisible to both Windows AND your security software.

According to the engineer, the rootkit detects write operations to fix the problem, and swaps it out with a read operation. It looks to the user that the command fixed the problem but really has not.

Rootkits are often planted by attackers to hide follow-on malware, such as banking password-stealing Trojans.  Rootkits have been around for a long time and are nothing new.  They are usually hard to get rid of because of the way they do hide themselves, this new one makes it that much more difficult because it hides "outside" of the normal places where most security software can scan.

Following basic security rules like not opening suspicious emails, visiting sketchy websites that want to you to download "special" software to watch a video, can lessen the likely hood that you will get infected.  And if by chance you do get infected, your best bet is to power down your PC and remove it from the network and have it checked by a professional.  Having a backup of your most important files will save time and resources and get you back up and running sooner.

If you have any system questions or concerns, call the CCS Retail Support Department at 800-672-4806 or email us.

-Bryan

 

Are You Secure?

Adapted from Fox News

Even though the promise of IPv6 is one of more security, IPv4 has earned its bones over the past few decades, and we’ve familiarized ourselves with what it can and cannot do. On the other hand, we have little to no experience with IPv6 in the real world. On paper, IPv6 looks great.But, I’m sure the Titanic did too. At best, IPv6 facilitates better security, it doesn’t guarantee it. 

Case in point: IPSec.  Essentially, this secures IP communication by encrypting and authenticating IP packets. In IPv4, it was optional as a feature; in IPv6, it’s mandatory. Making a feature mandatory doesn’t mean it will find widespread support; the point is, IPv6 isn’t automatically more secure. It’s going to take a lot of pre-rollout preparation and an immense amount of security vigilance to get it right.

For businesses, there’s a lot to consider, and this will likely fall into the lap of the IT department.  There are all sorts of pitfalls to avoid, and here are some to keep on top of at all times.

Buggy Programming.  This is where things usually fall apart.  In a transition this complex, on a scale this large, programmers are much more likely to make mistakes in the implementation, which could leave vulnerabilities wide open to hackers, negating the effectiveness of IPv6’s bells and whistles of security.  The worst-case scenario is actually ending up with an IPv6 infrastructure that’s even more brittle than the IPv4 infrastructure before it, placing a business at even greater risk, by amplifying the attack space.

Transition Exploitation. This migration is going to take a while, and until then, businesses will be straddling a dual IPv4/IPv6 environment, each with its own specific set of security problems.This ups the workload for companies’ networking staff and increases the number of ways things could go wrong. This is where security vigilance is crucial; due to this hybrid interim, we’re going to encounter unusual situations where hackers can potentially take advance of an interaction between the protocols.

Ineffective Blacklists. While IP blacklisting has been successful in reducing the global volume of spam, there’s the concern that ISPs won’t be able to scale IP blacklisting to IPv6, given its sheer size. This represents the problem that some security techniques may not transition very well from IPv4 to IPv6, giving hackers even more room with which to mount their attacks.

DDos Attacks. Distributed denial of service (DDoS) attacks, which overwhelm a computer network or Web site to make it useless, will still pose a threat to businesses in IPv6.  While IPsec can mitigate the effects of DDoS attacks to some degree, it does not prevent them, leaving resources at risk of being bombarded and brought to a complete stop. Broadcast amplification attacks, like “smurf” attacks, can do exactly that: keep you from your customer.

Evading Security Measures. Fragmentation attacks will still be a problem in IPv6, although architectural changes mitigate these attacks more efficiently. Fragmentation attacks can be used to evade, intrusion detection systems [IDS], intrusion prevention systems [IPS], and firewalls–often a business’s only means for learning when they’re being attacked. Once they’re in, everything is fair game: client information, credentials, e-mails and trade secrets.

Masking Points of Origin. Spoofing attacks will still be a threat in IPv6, but the new IPsec mandate will better manage this threat for businesses. Spoofing allows hackers to conceal their identities, making it hard to track them down after an attack. It can also be used to fake an identity–to implicate an innocent person or company in an attack in which they had no real involvement. Attacks aren’t limited to those that try to steal information or destroy resources, they can actually attempt to tarnish the company’s reputation.

Hopefully as technology advances and with a better understanding on how IPV6 will work in the real world, some of these issues can be addressed.  Security is still one of the more important areas in business.  Are you secure?

 
If you have system questions or concerns. Or would like to have a Security Review of your business network, give the CCS Retail Systems Support Department a call at 800-672-4806 or email us

-Bryan 

Source: The Seattle Times

Google is adding new features for people to search by image and something called Instant Pages to speed up websites that show up in search results.
 
The company talked about the new features at a news event in Mountain View Tuesday morning. While Google is the dominant search engine on the web, second-place competitor Microsoft Bing has been rolling out new features every couple of months.

Here is what the new features are about. 

Search by Image. Instead of searching with words, you can do a search by dragging an image over the Google search box. This works both with photos on the Web and with photos stored on your computer.
 
The feature builds in Google Goggles, which lets you snap a photo with a mobile phone camera and do a search on your phone.

I tried this today and it was not working for me, give it a try and see if you like it.
 
Google says it’s rolling out now in 40 languages.

The other new feature is called: 

Instant Pages. When you do a search on Google and click on the results, the website will show up faster because Google will preload the website as you search. This works on the next version of Google’s Web browser Chrome, which is now available in a beta test version.The Chrome browser competes with Microsoft’s Internet Explorer and Mozilla’s Firefox.

If you have any system questions or concerns, call the CCS Retail Support Department at 800-672-4806 or email us.

-Bryan