The Stand-up Philosopher

Who Hacked My Facebook Account?

Somebody has apparently hacked into my Facebook account and sent nasty messages to my wife as me. I’m trying to imagine who has the skill to pull this off, plus the time to bother to do it. I’m also wondering who could consider me important enough to mess with like this.

If you happen to know who has done this, please let me know. If a similar thing has happened to you, let me know how you dealt with it. It happened last year, which caused me to change my password. My password has apparently already been hacked again.

___________________________________________________

Upon further investigation, these messages aren't coming from my account.

CNET: McAfee's Big Blunder

CNET has a blog post about McAfee's Big Blunder. Recently, McAfee pushed out a buggy software update. It didn't affect me, as I've long since banished McAfee and Norton from my network. I'm all for keeping my computer safe, but both are far too needy for attention, and demand too much of a performance sacrifice.

I swore off Norton after their Norton Internet Security 2005. I had a copy of NIS 2003. After about 3 weeks, I'd start getting notices that Norton quarantined and deleted my email. I couldn't retrieve it. Then people would start asking me "Did you get my email?" Well, no. I uninstalled and reinstalled NIS 2003 and the same thing happened within 3 weeks. After my 3rd try, I uninstalled it and used the disk as a coaster after it wouldn't sell on Ebay.

I got a laptop for Christmas 2005. I was just getting started at the University of Phoenix and my old P-II 233Mhz Toshiba laptop couldn't keep up. I got a Compaq, which came with a 90 day trial of NIS 2005. It didn't last 2 months. NIS 2005 seemed to have to download updates every 20 minutes, and had to flash a status balloon on my taskbar to notify me of each individual step it was taking. The problem is, I like to hide my taskbar for screen Real Estate, so when an attention needy program like NIS 2005 wants to keep telling me what it's doing, it gets in the way. It also started letting me know way too frequently that my 90 day trial was running out in 89 days, 88 days, etc. Go away, Norton. Nobody likes you.

No Need To Pay For Security on Your PC. Lifehaker Says MS Security Essentials Are Enough

Most of my non-geek friends like to ask me about security. I tell them that unless they look at a lot of porn or spend time downloading pirated software, then they don’t need to worry as much. It’s not that big a deal.

Microsoft once had Windows Live OneCare. I hated the beta version, and installed it after less than 15 minutes. As it matured, I found it to be very useful, and I would recommend it to friends who asked what I though. I’ve long since had it with Norton and McAfee, although I’ve heard since they days that they gave me a bad taste that they’ve optimized their products so they don’t require as much time and attention, as well as system resources. I’m still not ready to pay for either again.

While Windows Live OneCare was a paid product, Microsoft now has Microsoft Security Essentials, which is free. Lifehaker says it works well enough that Windows users shouldn’t have to shell out money for other security products.

Symantec Video Highlights the Dangers of Shortened URLs

Lifehacker linked to a Symantec video showing the dangers of shortened URLs. What is a shortened URL? When using an application like Twitter with a character limit, it's not always possible to include a long link to a website, video, or article that you'd like to share with others. You then go through a URL shortener to create a shorter link that can be shared with a brief comment in under 140 characters. URL shorteners have been around for years, but I didn't start using them until Twitter came along.

Picture by ShiYali

URL shorteners can be convenient and useful. The problem is, they can also be used to hide malicious sites. How can you tell a malicious site?

If you click on a link, and immediately get what looks like a Windows notification telling you that your computer has a virus, GET OUT OF THERE! If the virus notification recommends a specific program to take care of the problem, GET OUT OF THERE! Just close the windows. If they won't go away, restart your computer.

Why I Hate CAPTCHAs

I was reading my Google Reader feeds while eating breakfast this morning. The puppy, Dustmop, was laying on my feet. That has no relevance except that when she got up, my feet were cold. I found a post on Lifehacker that I wanted to email my wife. Google Reader Mobile doesn't seem to have the ability to email a post, but the feed item itself had a Feedburner link for "Email This." I did so. I entered my email address and my wife's email address. I neglected to include a message text, because I didn't care. I figured that my wife can put together the point of emailing this link to her from the link itself. However, Feedburner insisted that I enter a message. I typed the letter "m", mostly because it was closest to my finger at that point in time. Hey, it's Labor Day, and I'm trying to save some labor! I then entered the freaking CAPTCHA, only to get the message

Figure 1: The Message

I checked and double checked, entered and reentered the freaking CAPTCHA, all to no avail. The message "Please enter the characters displayed in the box. If you are unable to see the text clearly, you may reload this window for a new image" kept appearing even though I had entered the text displayed on the screen. I tried two CAPTCHAs, and it took neither.

Figure 2: The Characters Displayed in the Box

By this point, I gave up and came upstairs to email the Lifehacker post from my laptop. I hate CAPTCHAs. Most of the time, even if I can clearly read them, the script won't take my answer. I quit using Blogger because of this.

Technorati Tags: CAPTCHAs,Blogger,post security,Lifehacker,email

Pain in the A$$words

Pardon the title. It’s late, and I’m strung out, and tired, and I’m just trying to make a point. Passwords and sign on security are getting to the point where I’m ready to just ditch my precious technology and go live on a mountain in Montana or something. I’ve tried since getting on the Internet in 1996 to keep fairly standard passwords so that I don’t have to remember (and record, which can be stolen) my passwords and logon information, especially at work where I often deal with sensitive accounts. It can be a security violation to write down a password for some of the networks that I need to access. The problem is that password standards are reaching the point where it is impossible to NOT maintain a record. What do you do when you need to access three or more networks or websites, each has a different logon, with different password requirements and change periodicity? How do you remember rand keep all of that straight? Some passwords that I’m required to keep have to be a minimum of 14 characters, with at least 1 number, one upper case letter, one lower case letter, and one special character.

PayPal just about pushed me over the top this evening. I used their system for a transaction today, and got an email later that they believe my account has been accessed by a 3rd party and had a restriction placed on it. I went through the processes to lift the restriction. The first step had to do with verifying my location. They needed a phone number. It’s been so long since I’ve done anything with my PayPal account that they still had my landline number that was disconnected more than 3 years ago when we got fed up with paying Verizon $50 a month for an open conduit for telemarketers and cut them off. Now we’re Paying AT&T (The NEW AT&T) for spotty coverage and non-connected calls, but at least no telemarketers. I input my Grand Central number, and PayPal called it. My cell phone rang as it was supposed to and I input the security code. When I hit NEXT on the web page, PayPal said that they can’t verify my location based on that number and they’ll have to mail me a letter. No CRAP PAYPAL! It’s 2008! People have like cell phones and Grand Central numbers and stuff, you freaking idiots!

Next I had to change my password. That sucked. I had to write it down, because there is no way I’ll remember it. I’ve used the same password with PayPal for years. Oh, yeah, then there were those idiotic security questions. Mostly they’re useless to me. What is your favorite restaurant? I don’t know, it changes every week. Who was your favorite teacher? I don’t know, I grew up in the Air Force, went in the Navy, went to ITT Tech and University of Phoenix. I’ve had tons of teachers. I’m not likely to remember very many. I hate those stupid security questions because most of them don’t apply to me. Who is your favorite sports team? I hate sports, I have no use for sports, and as such I have no favorite team. I’m too much of an egghead to just pick one because I’m a geek and I can’t take that kind of lying to myself.

Something has got to be done about security. For the time being, I’m using KeePass on my Pocket PC to keep track of logins and passwords, but even that is getting to be too cumbersome. Somebody needs to straighten things out. I almost just closed my account with PayPal over this, because it’s a pain. At some point, security and convenience need to meet each other and shake hands and come up with a way to coexist.

Technorati Tags: Security,Passwords

Essential Wireless Security- Watch Out for this potential trick

As wireless devices and services become more commonplace, we can also expect hackers and criminals to find new ways to trap us. I've read about a certain trick that some people will use to phish for information, and today I managed to catch a screen shot of this trick in action. I'm not saying that this is the trick, but this is certainly something that you should watch out for as you go about looking for a wireless hotspot in order to do your business, check email, check sports scores, or whatever you do.

I had to reboot my laptop at work today. While using Firefox, any time I tried to type, weird things happened. I selected the address bar and began to type an address that began with c, and my Open File window came up. When I typed www, tabs started closing. I realized it was probably time to reboot, so I did.

   

When my laptop came back up, I saw a balloon informing me that wireless networks were available. I've never seen a wireless network here before, so I thought I'd check it out. The network said "Free Internet Access", but I noticed something: this was a computer-to-computer network, rather than a router network as you can see from this screen shot.

This is something that people will do in order to collect data. They may have their own connection through a broadband card from a cellular carrier, and they will open up another connection that broadcasts "Free Wireless Internet". You see that and needing a free wireless internet connection yourself, click on it and find a connection. The only thing is that all of your data is going through their computer, where it can be intercepted. You may be using encryption, but the possibility exists for that encryption to be broken. Your passwords and credit card numbers can be harvested for use.

Stay away from these computer-to-computer "free wireless" access points. You don't know whether any particular access point is good or not, so why chance it?

Technorati tags: security, scams, wireless security, free internet access, free wireless access

Labels: Scams, Security

CNET's Top 5 Crapware

I haven't written about computers or technology for a while, but CNET gave me the perfect opportunity for a quick entry. Recently, CNET TV had a 2 + minute show about the Top 5 Crapware products. Over the years, many terms have sprung up to differentiate between the categories of software. Freeware is self-explanatory, being software that is free. Wares or warez are pirated or cracked full versions of programs such as Microsoft Office or Adobe Photoshop. A lot of software DRM (Digital Rights Management) has been produced to stop warez. Shareware is a type of software that typically allows a trial period before requiring purchase, but encourages you to share or pass along to your friends. Many aspiring programmers get started out with shareware, in fact, Steve Pavlina says that he got his start as a shareware games developer.

Malware is software designed for malicious purposes such as computer viruses, worms, and trojans, named after the Trojan Horse of ancient Greek history or legend. Spyware is designed to spy on you and send back information about your habits or even worse, keystrokes such as login and password information.

Crapware is a category all to itself. I'm sure that somebody has cooked up a wonderful and eloquent definition for crapware, but put simply, crapware is software that is utter crap and chances are you never asked for it in the first place. This includes unwanted browser toolbars and media players that just seem to show up. Some programs try to install trials of partner's products. Have you ever installed Intuit's Quicken and found shortcuts all over your desktop for things like Quicken Brokerage, Mastercard, and America Offline? Crapware is not limited to unwanted partner software. Some full version applications by supposedly reputable vendors can fall into this category. I actually consider Symantec's Norton Internet Security to be complete and total crapware. It bogs down my system, loses my email, blocks programs that I want to access the internet from accessing the internet, can't do the simplest process like update itself without constantly flashing a window on my taskbar to tell me what file it's updating, and it starts reminding you that you have to pay for a renewal way too early. I can't stand it. I also place McAfee's Internet Security in the crapware category after my last experience with their product. To be fair, it was the version that Comcast provides for free to subscribers, but it was an utter nightmare. It shut down my ability to share files across my home network, my Macs wouldn't even show up on it's network map because they didn't have McAfee installed (and no version was available to install), and I finally uninstalled the darn thing and decided I'd rather run unprotected than completely hindered in my normal activities. I spent 2 days searching for help. McAfee's website was actually more useless than Microsoft's (if that's possible) for finding answers, and even though I had every setting set properly I still could not connect from one computer to the other across my home network or Hamachi.

CNET's brief video deals with the crapware that computer vendors install on brand new computers. Except for laptops, I've always built my own systems, which cuts down on this dramatically. My sister in law lived with some stupid jukebox program that Dell installed on her laptop asking her to buy a music subscription every time she tried to play one of her own songs, until she finally shared that detail with me and I set iTunes to her default player and uninstalled the crappy jukebox software.

If you've ever bought a new computer that made you feel like you were living in a commercial after you booted it up, then kick back with a cold drink and watch this video. If you're thinking about building your own computer, let this inspire you while you wait for me to produce a series of blog posts on building your own computer. It'll be a while though; I'm still putting most of my time into famiy, church, and and finishing my IT degree.

CNET TV's Top 5 Crapware

 

Technorati tags: Crapware, software, computer vendors, Dell, HP, Compaq

Labels: Apple, DRM, Media, Microsoft Windows, Security, Software

The Most Pointless "Security" Feature (prior to Windows Vista)

I have to ask this question: What is the point to this stupid pop-up browser question?

In more than 10 years of using the internet, I have NEVER, under a single circumstance, encountered a situation where I would answer this stupid, useless, and annoying pop-up as no. The reason I ask is because normally this is only annoying, but today I am being forced by my organization to undertake a 1 and 1/2 hour internet based training session on "Information Security", and every single time I click the next link, I have to answer this pop-up. Is there a way to turn this worthless thing off?

Labels: Microsoft Windows, Security

Basic Windows XP Home Edition Security

This tip probably applies to the Media Center and Tablet PC editions of Windows XP as well. Windows XP Professional allows for setting of administrator passwords from within the running operating system, and if you're running Pro I'm sure you know how to do this anyway.

I've come to look at computer security as a fine balance between how hard you're willing to work to keep people out and how hard those people are willing to work to break in. Chances are that a personal laptop running Windows XP Home won't be too much of a target, although the possibility exists. Security can, of course, be taken to extremes in any direction. I'm just going to talk about one of the simplest things you can do to begin to secure your XP Home system.

It's always a good idea to password protect your user account no matter which operating system you happen to be running. This can be accessed from the Control Panel under the User Accounts icon. In XP Home, however, there is a hidden Administrator account which only appears in Safe Mode. This means that you can only set the password for this account in safe mode. Most XP Home users run with administrative privileges, but there is an admin account. If somebody steals your laptop or breaks into your system, they don't need your password. All they have to do is boot your computer up into Safe Mode and access through the admin account.

Here is how to set the password for the Admin account.

Boot up your system. After the BIOS screen (bootup screen) passes, press F8. You'll be taken to a text menu. Select "Safe Mode". You don't need to select "Safe Mode with networking", and you especially don't want "Safe Mode with command prompt".

Once your system starts up in Safe Mode, select Start->Control Panel. Then click the "User Accounts". Select the Administrator Account and select the menu item for change or create password. (I don't have an XP Home Safe Mode right in front of me, so I'm not sure of the exact wording but you'll see it). After you've created a password, you may also want to enable the Guest account.  This way if somebody wants to use your system but you don't want them to have access to your files and settings, they can use the guest account to access the internet or do some basic tasks.

This is not comprehensive, but it is one of the most elementary steps you can take to secure a Windows XP computer.

Labels: Microsoft Windows, Security

Norton Strikes Again

I got a call from a friend of mine yesterday with a tech support question. He had last used his laptop on a wireless network while traveling, but once he got home and tried plugging it back into his router, he couldn't get anywhere with Internet Exploder. He said the laptop was connected but IE would not connect to anything. He had already called HP and was told it might be a driver problem. It's too bad tech support desks don't hire people with real experience to offer tech support. Of course, how many of us with real experience could stand to do that kind of work for that kind of pay?

I walked him through some of the basics (does the network icon in the system tray have an x on it? etc). Then the answer came to me. I asked him if he was running Norton Internet Security. He said yes. I told him to right click on the Norton IS icon in the taskbar and select "Close" or "Exit". He did. Wouldn't you know that suddenly IE could connect to websites?

I'm not sure of the technical issues behind it. I can pretty much sum this up with "Norton sucks". I can't say I've ever had pleasant experiences with Norton's security products. Several years ago, I was given a copy of Norton Internet Security 2003. The first thing I noticed is that it sucked more than half of my computer's performance capability away in the resources it consumed. I ran it for a couple of weeks before I got home from work to a message that Norton AV had crashed and needed to be reinstalled. I reinstalled the product. Then I started getting messages from Norton Anti-Spam that some emails had been deleted. Funny, this was about the time that my mom started calling me to ask when I hadn't replied to a question she asked. Then Norton IS crashed again and had to be reinstalled. I used the products for a while because don't you know how insecure Windows is? I got tired of emails being deleted with no chance of retrieving them, and I got tired of reinstalling both applications every 3 weeks. I finally shelved the product.

My laptop that I got last Christmas came with Norton Internet Security and a 90 day subscription to Norton Anti-Virus. This time it was the 2005 version. I didn't bother with Norton Anti-Spam for long. I don't think anti-spam programs are very effective and you can read my strategy for dealing with spam here: http://emuelle1.blogspot.com/2006/06/how-i-deal-with-spam.html.  I found Norton Internet Security to be about as painful to use as always. I had one program I liked to use that for some reason I could not get Norton to allow. Any time I tried to manually input this program into Norton's allow menu, Norton locked up and I had to force my laptop to shut down and then reboot in order to recover. Whenever I wanted to run this program, I had to manually shut Norton down. When my subscription for Norton AV ran out, I happily uninstalled the suite.

Norton lately is bitching and complaining that Microsoft won't make it easy for users to switch their security center over to Norton's. I see this as a good thing. With the pains that I've been through with Norton's 2003 and 2005 suites, trust me, you're better off with the built in security center in Windows Vista. At least Windows won't suddenly start blocking Internet Exploder for no apparent reason.

If you suddenly find a your web browser not connecting, but Windows says there is a network connection, and you have Norton installed, try shutting down Norton. Then uninstall it.

Labels: Security, Software, Spam