Attack Computer Wiz

In some cases users in an Active Directory environment may see repeated lockouts after a recent password change. This is commonly associated with forgetting their new password, forgetting that they are logged onto another machine or server somewhere, or their old credentials are cached.

If after you have rebooted the machine, checked domain logs to try to figure out where accounts may be logged in, deleted Temporary Internet Files and you are at your whits end, cached credentials may likely be your culprit.

On your affected machine, run the blow command and delete any cached credentials that appear. This would especially be relevant if you are using a Proxy server.

rundll32.exe keymgr.dll, KRShowKeyMgr

Posted by Mike Wright

Chester Wisniewski over at Sophos posted an article yesterday on the inner workings of a fake anti-virus company. It is a good story and well worth the read. You can find it at the link below. Often support people and users ask me how these types of virus’, worms, etc., make it past our firewalls, AV, and other controls that they spend so much money on. This story points out that this particular fave AV vendor updates there payloads every two hours.

Wow!

This is an example of how technology cannot fix stupid human behavior. Really, how can vendors create definitions within a two hour window? Fake AV is not a technology problem, it is a people problem. In many cases fake AV is a social engineering trick that dupes the user into infecting their own system. People need to be educated on what these types of attacks look like, how to prevent them, and who to notify when they occur (or are suspected).

 "A sneak peek into fake anti-virus affiliate support"

Posted by Mike Wright

Whether it be a syntax error or a new "feature", PayPal emails, when opening in Outlook have suddenly started to cause extreme delays or even crashing Outlook altogether. Upon launching Outlook 2010 some may notice there is a delay and Outlook displays a message about "Contacting \\102.112.2o7.net\b\ss\paypalglobal....". Now that we know where the hang up is we can create an easy fix to stop Outlook from tying to contact this URL. Follows these steps and your email client will start working again!

1. Open Notepad.exe, (if running Vista or Windows 7 you need to open Notepad.exe by right clicking the exe and choosing "Run as Administrator"),
2. Open your hosts file "C:\Windows\System32\Drivers\etc\hosts,
3. Paste the following at the bottom of the Hosts file

   127.0.0.1    102.112.2o7.net

4. Save the Hosts file and restart Outlook.

Enjoy pause and crash free email!

Posted by Mike Wright

Amazon announced today the launch of their "Cloud Drive" online storage service. Anyone can get 5GB of free storage that can be used to store and stream audio, photos, and other files. Want more, no problem, for $20/year or free with the purchase of a single album from Amazon you can have your storage increased to 20GB. Amazon has a tiered plan that can increase your storage for $1/GB/year. They also tout that you can access your files from any computer and many devices (not Apple though).

It is a great idea but Amazon is very late to this game and their pricing structure is incredibly high... no not incredibly high, astronomically high and they didn't even slap an apple logo on it to justify the rates! $1,000 per year for a 1000GB plan is insane. No music collection can possibly worth that.

There are other, better solutions for online file storage. Mozy for one; Their unlimitied plan seems to be gone but I still think they beat Amazon. Or even better, Carbonite which offers "Unlimited" storage for only $54.95/year. Carbonite, similar to Amazon, allows you to access your file from any computer and many mobile devices, including Apple devices.

Posted by Mike Wright

The Internet Corporation for Assigned Names and Numbers (ICANN) has finally approved the .XXX top level domain name. This clears the way for pornography and other sexually explicit material a new, clearly marked and obvious, home on the internet. This will help schools, organizations, companies, and parents have the ability to block and review access to such material.

It appears (or I missed it) that there is no longer the requirement for existing adult sites to move their .com's to the new .xxx and having penalties if they did not. This may have been the provision that got the final green light.

Source: PC Magazine
Other posts by me on this subject: .xxx Domains Could be 70 Days Away! and .xxx Domain for Pornographic Websites

Posted by Mike Wright

Are you a system builder or just rebuilding your Windows computer? Are you tired of having to go out and download application after application to get the system back to where you want it? It is such a hassle to  to go out to all those vendor websites, download the software, click through all of the installation screen, un-check the tool bars and addon's, agree to the licenses, and so on.

A friend of mine found a great website that allows you to select the applications that you want to install by simply checking a box. After you select the programs you simply click the "Get Installer" button and run the custom installer. Soon every application that you selected will be downloaded and installed for you. Headache and hassle free! As of this post there are about 84 free and/or open source applications available for quick and easy download and installation including; iTunes, VLC, Flash, Safari, FireFox, 7zip, WinRAR, Open Office, Skype, Chrome, and many more. Check it out.

NiNite.com is the greatest thing since sliced bread!

Posted by Mike Wright

Here is a good writeup about a scam going around. It is written by Rik Ferguson over at Trend Micro.


http://countermeasures.trendmicro.eu/an-unwanted-favour-from-india/

Posted by Mike Wright

I found a great write-up on different ways to hide your email address from spiders that are designed to 'crawl' the Internet and find email addresses. Once found, these addresses are sold to Spammer's and the junk mail pours in. Using some very simple techniques, you can add code to your email link to mask your actual email address from these automated tools.

Below is the link to the original site:
Digital Inspiration: Hide your email address on websites from spam

Posted by Mike Wright

I first introduced you to Blippy.com in my post on March 16, 2010 titled "Blippy.com, a Whole New Level of Stupid". It has just been discovered that using a simple Google search you can see actual credit card numbers of Blippy users. This Google search is very similar to the method that I showed you in my first post.

You can see an example of the Google results in the screen shots below. At the time of this post the Google search is broken but there are plenty of examples on the internet. The breach was acknowledged by Blippy management and they state that it was an over site during some beta testing that they were preforming.

Blippy.com, a Whole Whole New Level of Stupid!

Image 1 credit: venturebeat.com
Image 2 credit: CNET/Google
Source: CNET
Source: Venture Beat

Posted by Mike Wright

Google researchers will be releasing their results from a 13 month study into rogue antivirus malware operations on April 27 at the 'Workshop on Large Scale Exploits and Emergent Threats' in San Jose.

The study covered approximately 240 million Web pages finding approximately 11,000 domains that distributed rogue antivirus. Rogue antivirus, or Fake AV, malware is a scam in the form of a popup notice advising the user that their computer is infected with a virus and that they need to “click” to remove the virus.

Clicking, of course, installs the rogue software then extorts the user into purchasing a "full" version of their software. In the mean time the computer system is relatively useless until some sort of action is taken.

When it comes to Fake AV and other malware of this type you should;

1. Just don’t click on it to begin with.
2. Use Web of Trust to scan your search results.
3. Be sure you have a valid antivirus application from a trusted vendor.

Source: eWeek
Source: Google Blog

Posted by Mike Wright

I recently ran across an excellent write up on the recommended steps to take for anyone who is duped into answering a Phishing Scam.

Full credit goes to Dan Keen of eHow.com

************************* Quote *************************

By Dan Keen, eHow Contributing Writer

Phishing is the name given to an Internet scam where criminals send emails to unsuspecting victims in an attempt to lure them into giving financial and personal information. For example, a victim may receive an email that appears to be from his bank requesting his account number and passwords. The email tells the unsuspecting victim that this information must be checked because the bank has noticed unusual activity on the account. This is a hoax.

Contact the Impersonated Company
Notify the impersonated company about the email you received. Many large companies have a 24-hour, toll-free number to handle these kinds of emergency situations.

Notify Government Agencies
Forward the fraudulent email to spam@uce.gov, and to the Federal Trade Commission at their "Identity Theft" website: ftc.gov/idtheft.

File a Complaint With the FBI
File a formal complaint with the FBI's Internet Crime Compliant Center at their website: www.ic3.gov.

Close Accounts With the Impersonated Company
Quickly close the accounts you have with the company whose name has been fraudulently used in the email to you. For credit and debit cards, have the company issue you new cards with new numbers.

Report to the Three Major Credit Reporting Agencies
File a report with Experian (fraud line is (888) 397-3742), Equifax (fraud line is (800) 525-6285) and TransUnion (fraud line is (800) 680-7289). Notify them of possible identity theft, and request that a "fraud alert" be placed on your account.

Report Scam to Anti-Phishing Working Group
Report the scam to an organization known as The Anti-Phishing Working Group, which is comprised of law enforcement agencies, financial institutions and Internet security vendors. Email to them at reportphishing@antiphishing.org.

Be Alert to Identity Theft
Victims of phishing scams, which compromise personal and financial information, are likely to also become victims of identity theft. Keep a timely check on your bank accounts, and statements from store credit cards and major credit and debit cards.

*********************** End Quote ***********************
Source: eHow.com

Posted by Mike Wright

I ran across an application a few months ago but it was not until recently that I had the time and the need to use it. Microsoft's Windows Live Family Safety software can help you keep your children safe online.

There are four basic components to this application:

Web Filtering: Web filtering allows you to specify the types of web sites that your children can access. There are three settings; Strict, Basic, and Custom. Strict is the most restrictive only allowing a small list of websites. You can see that list here. I recommend this setting for younger children. Also in web filtering you can specify specific web sites that you would like to allow or block. Also you can allow or prevent the child from being able to download any files.

Activity Monitoring: Activity monitoring allows you to see a near real time log of all internet activity. You can see exactly what websites your children are visiting, when they visited them, and whether or not they were allowed or blocked when accessing them. From here, you can also change the setting allowing or blocking the site for future visits.

Contact Management: Contact management can control who your child chats with or emails online using Hotmail, Messenger and Spaces. Remember, you can block all other email, chat, and networking websites and force them to use only these.

Requests: On the computer that your child is using, when they access a site that is blocked, they have the ability to click a link to request that you allow them to view the site in the future. In the requests section you will find and be able to authorize or deny any of those requests.

If this sounds good to you, please continue reading and I will walk your through how to install and configure.

How to Install:

1. You must have a Live account. If you have a Hotmail account you already have one. You can sign up at Live.com.
2. You need to log into the child’s computer with your user account. This account will have the ability to make configuration changes and install the application.
3. You need to make sure that your user account has a password. It can be whatever password you want, and depending on your child’s age, it could be very basic.
4. You need to ensure that the name of the computer is not the same as the name of any of the user accounts. This seems silly, but I learned this the hard way. For example: If your child’s user name is “Johnny” you must ensure that the computer name is not “Johnny”. If it is change the computer or user name or you will fail when configuring the system.
5. Download the application from this link.
6. Logged on with your administrator account, on the child’s computer, double-click the application that you just downloaded.
7. You are presented with options to install multiple items. I suggest, at this point, you un-check all applications with the exception of “Family Safety”. Click “Install” and follow the instructions as they are presented.

How to Configure:

1. After you install the application you will need to launch it by clicking “Start” > “Programs” > “Windows Live” > “Windows Live Family Safety”.
2. The first screen you see will ask you to log into your Live account.
3. After you have successfully logged in you will be asked to choose the user account that you wish to monitor. Check the box, click “Save”, then click “Close”.
4. Now you need to log in to your Live account by clicking on this link.
5. Click on “Edit settings” under the user name of your child.
6. Now you will see the links for each of the four sections that I listed above. I suggest that you review each section and configure it accordingly. Be sure that you click “Save” at the top of the screen after your changes so that they can take effect.

I know that’s a lot to take in, but I think it is well worth it!

Posted by Mike Wright

Trying to access YouTube this morning proved a little difficult prompting me to wonder if the site had been hacked or was experiencing a denial of service attack. According to the Register a YouTube spokesperson was quoted as saying, "We apologize for the inconvenience, but YouTube is temporarily unavailable. Our engineers are currently working to restore the site."

Though I cannot find any other reports, so this is pure speculation on my part: Last night I noticed that the Google Adsense network seemed to be down for about an hour around 1800-1900 PST. I first noticed that all of the Google advertisements on our site were mysteriously gone at around 1800 PST. I then surfed on over to at least a dozen other sites that I know have Google ads only to discover that there was none displayed their either.

Another round of pure speculation: During the same time last night when Google Adsense was not working, GoDaddy DNS seemed to be having a hiccup. The ACW domain is hosted at GoDaddy and I have a DNS redirect to our blogger site. Around 1800 PST last night, when accessing our site, I received a 'Service Unavailable' message from GoDaddy.

If I am right about the Adsense outage and the GoDaddy issues I was having, then that would make GoDaddy and two major Google services down in less than a twelve hour period. This just days after Google went on the offensive with China and a day after GoDaddy joined forces with Google.

Things that make you go hmm.

*Update 3/25/2010 1845 PST: Google is is stating that the YouTube outage was a "Technical Issue" and not a denial of service attack. There still is no mention of any Google Adsense or GoDaddy outage. LINK

Posted by Mike Wright

GoDaddy is reporting today that they will stop the sale of registered domain names in china. This is on the heels of Google’s protests of cyber attacks and censorship from that country.

Christine Jones of GoDaddy states, "We believe that many of the current abuses of the Internet originating in China are due to a lack of enforcement against criminal activities by the Chinese government." Jones goes on to say that GoDaddy has been combating dozens of attacks that appear to be originating from China over the past three months.

GoDaddy will support current customers with domains based in China.

Reuters

Posted by Mike Wright

According to Wikipedia’s Facebook page their website was down today for an undisclosed amount of time. They attribute the outage to overheating problems in their European data center which caused many of their servers to shut themselves down.

They state that they also experienced problems with their fail over plans and DNS resolution issues. Those issues were quickly resolved but they did expect some extra down time before access was completely restored.

As of 1422 PST they appear to be up and running.

Posted by Mike Wright

What would you think if I told you that there is a website that allows you to search anyone and find personal details about them? What if I told you that all I need to know is your name and the city you live in and I may be able to find your; address, phone number, cell phone number, spouses name, age, gender, race, marital status, education, hobbies, type of home, zodiac sign, whether or not you own your home, how long you have lived in your home, number of people living in your home, whether or not you have children, a photo of your home (yes a photo of your home!), and... Need I continue, or do I have your attention?

The website is spokeo.com who coins themselves as “Not your grandma’s phonebook”. This very easy to use search engine will locate just about anyone and allow you to learn a lot of information about them. Of course, it is not 100% accurate, but it is not too far off either!

Where do they get this information? I am sure a lot of it is dredged up from the internet and public record. I would imagine some of it is found on your social networking websites. But what about the data that is not common record or dredged up around the internet.

Let me use as an example my 90 year old grandmother who has never touched a computer. Why is her information there? Or my sister-in-law who told me about this site (I can see Mickey Mouse in your back yard). I know that she does not put her data on the internet.

Any conspiracy theorists want to tackle the US Census data?

To spokeo’s credit they do offer a way to remove yourself from their records and it is quite easy and effective. Below are the simple steps to remove yourself and your family members. Be warned, you can only make requests to remove two listings. I am not sure what the delay is before you can remove more.

1. Go to Spokeo.com
2. Enter the name of the person you want to search
3. Locate the person and click on them so that you see the profile on the right side
4. Now copy the URL from the address field of your web browser
5. Next, in the lower right corner of the page you will see a link named “Privacy”
6. Click on “Privacy” and paste the URL in the URL field, enter your valid email address and the captcha code
7. Click “Remove Listing”
8. Now go check your email and when you get the email confirmation follow the instructions to complete

Your results will be removed from the search usually within 24 hours, however I found that while I still showed up in the search, my data was removed within 20 minutes.

Posted by Mike Wright

I recently came upon the need to receive Gmail on multiple computers using Outlook. The problem I ran into was that once one computer downloaded the message, any additional computer would ignore it. This was a problem for me because I needed to have all of my messages delivered to all of my machines.

It is a very easy fix and here is the walk through;

1. Open your account settings for the Gmail account you wish to modify. For Outlook 2007: Click "Tools" > "Accounts Settings" > then double click the Gmail account.
2. Under "Logon Information" you probably see your user name, (example "joe845"). You need to modify that user name to include your full Gmail address and you must precede it with "recent:"
* For example, if your user name is "joe845" change it to "recent:joe845@gmail.com"
3. Now follow the same steps above on all of the machines you need to receive Gmail on.

That is all you need to do. If you get any initial errors sending or receiving, restart Outlook and try to send and receive again.

Posted by Mike Wright

If you get an email that appears to be from Facebook with the subject "Facebook Password Reset Confirmation! Customer Support." or anything similar to that, beware. The mail looks innocent enough to the untrained eye but there is a very dangerous attachment that could spell the end of your Facebook account as you know it.

The attachment looks like a zip file but is actually an application that installs on your computer once you run it. The application will log your Facebook user name and password and send it to whoever wrote the program. Also, the program will run for anyone who logs into the computer that you installed it on. So if you share this computer with family members or if it is a work computer, anyone who uses Facebook on that computer will also have their information stolen.

How can you protect yourself?

1. Don't open emails and especially don’t execute attachments from anyone you don’t know or recognize. Maybe even if you do know them?
2. Be sure your computer is up to date with the most current updates for your operating system and internet browser, at least.
3. And ensure that you have current and effective anti virus software enabled and running.

Source: McAfee

Posted by Mike Wright

With Firefox currently developing 3.7, Google working on Chrome 5, Opera just releasing 10.5, and Safari still on 4.05, Microsoft delivers more news on the web browser front. Microsoft just announced the preview of IE 9. In reading other articles it sounds as if IE 9 is in its infant stages. With that Mike and I will more than likely be installing it on a vmware workstation soon to try it out. We will keep you posted on our findings.

If you would like to get your own preview you can download it from http://ie.microsoft.com/testdrive/Default.html

Posted by Jason

Facebook does not have any authorized application that allows you to track who is visiting your profile. That means, that when you get a friend request asking you to install an application so that you can track people who visit your Facebook profile, you are being scammed.

These applications are classified as malware, or malicious software, and are designed to steal your information and reproduce itself. They do this by tricking you into installing their application, tricking you into allowing their application to access your Facebook profile, retrieving all of your information, and then propagating itself by sending itself to all of your Facebook Friends.

What can you do?

• If a friend sends you a request to join, forward them this article.
• Block the application if you already joined or are infected.
• Un-friend, un-follow, and un-fan the application.
• Change your Facebook password.
• Change your email password.

Remember, you are only infected if you installed the application and allowed the application to access your information. You can confirm this in a number of ways, in Facebook;

• In your profile, click Info, under pages click “See All”. Does everything look correct?
• Now click “Account”, “Application Settings”, then choose “Authorized” from the drop down list. Click the “X” for any unwanted applications.
• In the same area, choose “Allowed to Post” from the drop down list. Click the “X” for any unwanted applications.
• If you find any unwanted applications listed you should now change your Facebook password by clicking on “Account” then “Account Settings”. Now find “Password” and Click the “change” link. 
• Then ask your friends if they received any of these types of requests sent from your account.

Posted by Mike Wright