IT Security Blog

Trojan Hits Windows Mobile

By

pocketpc.jpgMcAfee, one of the industry’s leading software developers of anti-virus software have through its Avert Labs has discovered a new Trojan that infects WindowsCE which was developed for the Microsoft PocketPCs. The Trojan, disables data and network security rendering it useless and can be installed via memory card. The Trojan has the nasty ability to defy removal through software methods with the exception of a total re-format and re-installation of the applications and OS from a secure and safe source. Infected users are also asked not to use flash drives or memory sticks with saved data for they can also contain the code which spreads the trojan.The Trojan was discovered in China and makes itself the home page of the heavily reliant PocketPCs on the web. Information regarding the device, serial number and other personal information are then sent to the author of the Trojan leaving it open to future attacks and installation of malware due to security that has been turned off by the said Trojan.

The Trojan has been found contained snugly within legitimate installers and Asia being one of the fastest growing areas for mobile devices it would only take a little time before the said Trojan aptly named InfoJack spreads and wreaks havoc on Asia’s growing mobile PC community. The US-CERT or Computer Emergency Readiness Team has already taken notice of the said Trojan and is closely monitoring for further developments. Them along with anti-virus developers are currently developing methods of defeating the perpetrator and hopefully also capture the crook who designed the said malware.

Encrypted Hard Disks – Data Secure —Naaaahhhh!!!!

By

notsosecure.jpgAs the evolution of the lowly hard drive goes with the increase of storage capacity into the terabyte range and hardware based-encryption it seems that data cannot be more secure once it is stored within the said hard disk. Well, according to WindowsIt Pro, not totally for based on their testing of several hard drives that come as wireless removable storage devices you connect to your USB 2.0 ports, it ain’t that secure after all. The device/s tested was even secured by a wireless security key that used rfid technology to unlock the drive for use by authorized users only (which in the real world is anyone who has the keychain key).
The name and brand which we would not name for obvious reasons have indeed admitted the weakness and that the advertised capability of the drive was wrong. As it turns out, the true 128-bit AES security system was used only by the RF chip and the controller on the drive which was easily defeated by removing the drive from the case and connecting to a now standard SATA drive connector. The drive was encrypted, but not at the ‘military grade’ levels that were advertised for the encryption chip used only a basic encryption level which was not up to par with accepted high-encryption standards.

Both the manufacturers of the controller boards, casing and key, have acknowledged the flaw and promise a more robust system (which is to use a more secure encryption chip that is said to come out this year but is still only in development) by the end of the year. So we guess the false advertising with regards to the encryption standard of the drives should be changed from ‘Strong 128-bit AES encryption’ to ‘standard encryption’, which would only be fair for people do make choices based on the products qualities and capabilities.

IP-Based Security Surveillance ( Part -2 )

By

surveillance_1.jpg
The accessory cards for the standard PC has become so widespread that they come in many shapes and form allowing the connection of any number of security cameras. Triggered systems which rely on other security deterrents for activation allows the people monitoring the site to save on storage which used to be a bank of video recorders that were set to record in extended mode on a loop in a back office which was hopefully secure enough to prevent tampering and destruction by perpetrators. Off-site security allows monitoring over high-speed internet lines of the site without the danger of loosing valuable evidence in the form of video footage safely secured onto the company’s own storage servers or can be out-sourced to off-site data storage companies like Iron Mountain who specialize in secure and reliable data storage. The advent of high capacity hard drives like the Toshiba Terabyte Drive allows a huge amount of data to be stored with minimal hardware footprint. Seagate on the other hand has gone a step further by releasing hardware-based encryption in it’s hard drives which can be activated with the use of the Operating System making for one ultra-secure hard drive (well, till you forget the password or key to decrypt the drive making it useless or exceed the MTBF of the specified drive, ouch.. that’s 931 GB of lost data).
Security has become an ever present need and so is the drive to protect assets that are the essence of business organizations. These newer and cheaper versions of security systems add a level of security that assures us our assets stay safe and secure in the event of either man-made or natural disasters that are becoming quite common as life becomes harder and money is harder to come by turning people to a life of crime never before seen on this earth.

[tags]Securing Assets, Security[/tags]

IP-Based Security Surveillance ( Part -1 )

By

surveillance.jpg
Security cameras in its many shapes and forms have evolved into more of a necessity rather than a luxury usually available to those firms who could afford it. Developments in CCD technology and miniaturization of electronics components have allowed the price to fall steady making them widely available and easy to deploy. Similar to webcams, IP based security systems like the one from LPM, are now more and more becoming well accepted for like VoIP, it allows the video feed from a site hundreds of miles away to be sent over the internet to a security center in the company’s security center allowing centralized monitoring of warehouses and other facilities that would otherwise need security personnel saving in manpower costs.

The technology has evolved to a point that all one needs for IP-based security surveillance monitoring is a peripheral card one installs into the standard PC and the necessary cameras that are desired. Another deterrent of security systems of past was the requirement for extensive cabling which can be quite costly if one wishes to monitor a large area which needs to have all supporting cabling installed (power, video feed cables, audio cables, etc.). The advent of the many wireless radio communication technologies have also contributed to ease of implementation allowing wireless communication between a site’s central console and it’s subordinate cameras, who then send the information through the internet to it’s security base which can be a few blocs to hundreds of miles away.

[tags]Security Systems, Video Surveillance, Remote Security Systems, Asset Protection [/tags]

That darned USB port!

By

usbport.jpgusbplug.jpgUSB has been around for quite sometime and was designed to replace the interface capabilities of the old legacy standard. Today, most PC’s, Laptops and other peripherals have USB ports or have the capability of connecting to one such as keyboards, mice, digitizing pads, digital camera’s, video camera’s, flash disks and the device types goes on and on. They have become so common that many security experts warnings on their danger have gone unheeded, till now that is. Recent security holes and other problems associated with malware and viruses that have been transmitted through the USB port have risen to the point security people had to listen. These interface ports are quite convenient and easy to use that even the most beginner can plug an infected device such as a flash disk loaded with malware or viruses that they easily get through standard security. They are so small that physically banning them can be next to impossible and I’m sure you’ve read the several articles regarding the iPod which was connected to the corporate network…etc. Expert’s advice that to minimize their use for no good, disable them on-board or do not bother connecting them at all at the hardware level. This would render them truly unusable for some people however innocent of the workings of a PC or other computer type can enable them in the control panel easily. Unbeknownst to many, most devices that have flash memory can be used to store files other than video or pictures for they can be formatted using the operating system’s format utility or the propriety software such as iPod’s iTunes which can have even the most basic iPod Shuffle function as a flash disk allowing transport of say documents and other such files.

Passwords and back-up…still the best defense against data loss

By

carbonite.jpg
Security experts agree and still recommend that passwords be as tough as possible to prevent access to information on computer systems/networks. Yeah, it sounds very redundant and has become a bit tiring to read but it truly is the best protection ever for a computer may it be in the office or home. Encryption is one of the most promising technologies that has swept the IT security arena but even these robust encryption technologies (hardware/software based) protection technologies can be circumvented given enough time and resources.

Some companies have even turned to military-grade encryption which is tough and almost impossible to break but a wrong move along the way (encryption, transmission and decoding) can lead to catastrophic data loss. Carbonite has another approach to data security by actually backing up data offsite from subscriber’s computers may they be corporate or home users. The initial process of copying and indexing may take a few hours or even days depending on the amount of data to be copied but the subsequent back-up process which is simultaneous (which means that it works in the background when there is not much going on in terms of resource use) as one connects to the internet. So you can be working all day and stop fro a few minutes for a coffee break and return to a computer that has all the necessary information backed up by the system automatically.

Data loss due to hardware failure, software corruption due to malicious code (viruses and the likes) and people simply being reckless and deleting information without following the proper assessment of the information still cost a lot of money to recover from and the approach Carbonite uses is a better option. The system uses secure military-grade encryption which even the Carbonite servers cannot break and use adding to it the use of SSL in the transmission of the information for one mean back-up solution. As a user in the article says, it is like getting an insurance policy for your data. More on the said technology in the coming posts so do return and check us out from time to time for more information on the latest and hottest information from all over the world in terms of IT Security. Merry Christmas and a Happy New year to all.

[tags]Data Security, Data Backup, Strong Passwords[/tags]