How do you know if a system is infected with malware?
This question is important to journalists, testers and other reviewers of anti-malware software.
The security product may claim to have defeated the threat but you need to dig down into the system using forensic tools to be sure that it has succeeded.
The following links and notes are intended for the journalists who attended Kaspersky Lab's reviewers workshop this week:
Wireshark
http://www.wireshark.org/download.html
http://wiresharkdownloads.riverbed.com/wireshark/win32/Wireshark-win32-1.8.6.exe
http://wiresharkdownloads.riverbed.com/wireshark/win64/Wireshark-win64-1.8.6.exe
CaptureBAT
https://www.honeynet.org/node/315
https://www.honeynet.org/files/CaptureBAT-Setup-2.0.0-5574.exe
>> CaptureBAT.exe -l demo.txt -n -c
Autoruns
http://technet.microsoft.com/en-US/sysinternals
WinPrefetchView
http://www.nirsoft.net/utils/win_prefetch_view.html
http://www.nirsoft.net/utils/winprefetchview.zip
Volatility
https://code.google.com/p/volatility/
https://volatility.googlecode.com/files/volatility-2.2.standalone.exe
>> volatility-2.2.standalone.exe -f stuxnet.raw pslist
>> volatility-2.2.standalone.exe -f stuxnet.raw psscan
>> volatility-2.2.standalone.exe -f stuxnet.raw psxview
Malware Analyst's Handbook
http://www.malwarecookbook.com
http://goo.gl/7gONZ (specific page on Amazon.com)
Stuxnet analysis
http://mnin.blogspot.co.uk/2011/06/examining-stuxnets-footprint-in-memory.html
Showing posts with label books. Show all posts
Showing posts with label books. Show all posts
Monday, 15 April 2013
Tuesday, 6 December 2011
Are parents the best porn blockers?
 |
| Porn, art or education? |
TalkTalk's HomeSafe security product is supposed to block, "pornography, viruses and other potentially harmful content."
However, "for more than a week the system has failed to restrict access to Pornhub, which offers thousands of free explicit videos and is ranked as the third largest pornography provider on the web."
The report claims that HomeSafe "operates at the network level so parents do not need to install or maintain any software."
This incident supports my long-held belief that protecting children online is at least as much a parenting challenge as it is a technical one.
For one thing, a child is (usually) an intelligent and curious creature that will positively relish the challenge in bypassing whatever filters the parents or ISPs have put in place.
The following is a lightly-edited extract from a book I wrote in 2008. It was called The Complete Internet Security Handbook 2009. I think it's only available second-hand now.
What is pornography?
While some believe that pictures of naked bodies are beautiful or educational, rather than corrupting, society generally agrees that so-called 'hardcore' pornography (where sexual acts are clearly illustrated in full) are not ideal material for fresh young minds. In some countries these images and videos are illegal.
While some believe that pictures of naked bodies are beautiful or educational, rather than corrupting, society generally agrees that so-called 'hardcore' pornography (where sexual acts are clearly illustrated in full) are not ideal material for fresh young minds. In some countries these images and videos are illegal.
In the UK the law is not very clear but, for the purposes of this chapter, we're going to assume that you want to shield your child from anything more explicit than basic educational diagrams and photos of isolated naked bodies, genitals included.
Images of child abuse (sometimes erroneously known as 'child pornography') lie in a completely different category from any adult-based porn. It is illegal to produce, distribute or view such images, which are handled by different laws to adult porn. There is no grey area here – not only should you take every step to prevent your child from seeing it, you should avoid it yourself or face prosecution.
Images of child abuse (sometimes erroneously known as 'child pornography') lie in a completely different category from any adult-based porn. It is illegal to produce, distribute or view such images, which are handled by different laws to adult porn. There is no grey area here – not only should you take every step to prevent your child from seeing it, you should avoid it yourself or face prosecution.
Blocking porn and other content
There are technical ways to prevent internet porn entering your home, which I covered in the book. However, consider that young people are curious, inventive and probably better at using a computer than you are. If you intend to monitor their computer usage or block their access to parts of the internet, be aware that you may lose this game if you allow them unsupervised access to an internet-connected PC.
There are technical ways to prevent internet porn entering your home, which I covered in the book. However, consider that young people are curious, inventive and probably better at using a computer than you are. If you intend to monitor their computer usage or block their access to parts of the internet, be aware that you may lose this game if you allow them unsupervised access to an internet-connected PC.
A technical solution, such as parental control software and content-blocking firewalls may be less effective than keeping the family PC in the living room. A teenage is less likely to explore the darker parts of the internet when Mum or Dad are sitting nearby.
Some porn-blocking systems use keywords to decide if a site is bad or not. For example, a firewall or parental control system may block access to a site that contains sexual swear words. Another approach is for services to maintain lists of website addresses known to host sites containing dubious content. However, such services may be less helpful than you'd think.
When you try to block content, be it porn, gambling, violence or anything else, there is a risk that useful, legitimate sites will be blocked, while bad sites will still get through.
Some porn-blocking systems use keywords to decide if a site is bad or not. For example, a firewall or parental control system may block access to a site that contains sexual swear words. Another approach is for services to maintain lists of website addresses known to host sites containing dubious content. However, such services may be less helpful than you'd think.
When you try to block content, be it porn, gambling, violence or anything else, there is a risk that useful, legitimate sites will be blocked, while bad sites will still get through.
For example, a child in secondary education is most likely receiving some level of sexual education and it would not be inappropriate for this child to search for information on organs such as the penis and vagina. Some porn-blocking services may over-zealously block educational sites.
It is unrealistic to assume that every content-blocking service knows about every bad site. In fact, what you consider to be bad and what someone else thinks is unacceptable is probably quite different. Today's teenager, left unattended with an internet-connected PC, will find hardcore pornography if they have a mind to, regardless of the technical measures that you take.
It is unrealistic to assume that every content-blocking service knows about every bad site. In fact, what you consider to be bad and what someone else thinks is unacceptable is probably quite different. Today's teenager, left unattended with an internet-connected PC, will find hardcore pornography if they have a mind to, regardless of the technical measures that you take.
Work together
Because everyone has a different idea about what is and is not acceptable, there is currently no better system than sitting down with the young person in your care and working on the internet together. You can be on hand to guide their choices of websites and, in unfortunate cases where your choice was poor, you'll be in a position to browse away from content that you’d rather they did not see.
However, there are ways to block access to certain types of content and it may not be practical to supervise a child’s internet use constantly. If that is the case, you can use parental control systems to help reduce the risks that your child will face when going online.
Wednesday, 5 October 2011
How to use Metasploit
Two easy-to-follow guides.
Rapid7, the company that owns Metasploit, dropped by the lab yesterday to demonstrate some of its impressive products.
This prompts me to list two excellent sources of information on how to actually use Metasploit. For those new to the software, you could do much worse than read the free Metasploit Unleashed online tutorials at Offensive Security.
Additionally, the book entitled Metasploit: The Penetration Tester's Guide provides similar (but more detailed) information. It weighs more than my laptop, but that's a small price to pay!
Rapid7, the company that owns Metasploit, dropped by the lab yesterday to demonstrate some of its impressive products.
This prompts me to list two excellent sources of information on how to actually use Metasploit. For those new to the software, you could do much worse than read the free Metasploit Unleashed online tutorials at Offensive Security.
Additionally, the book entitled Metasploit: The Penetration Tester's Guide provides similar (but more detailed) information. It weighs more than my laptop, but that's a small price to pay!
Tuesday, 4 October 2011
No Computer Viruses: an end to malware?
I received the following press release yesterday:
I hope it's not going to just advocate, "install Linux and forget about malware" because, as many of us know, malware is not restricted to the Windows platform. I'm struggling to think of a current consumer computing platform that does not have at least basic malware samples available in one form or another. I'm pretty sure that IOS, Android, Linux and Mac OS X all receive their fair and generous share of security updates.
I am also pretty sure that if the majority of computer users migrated from using Microsoft operating systems to Some Other Operating System (SOOS) then we'd see a slew of SOOS malware before long. Nevertheless, the press release (emphasis and paragraphs added for clarity) continues:
* I would hope so. I pity the security firm that doesn't understand software vulnerabilities.
"CORRY, Pa. (MMD Newswire) October 3, 2011 - - "No Computer Viruses: No Antivirus Software Needed" (ISBN 1466274077) by J. Lynn takes readers through more than 25 years of computer technology history and offers a comprehensive argument for virus and malware prevention through the use of non-Windows operating systems."It will be interesting to see the content of this book, which is not yet available but promises to be on Amazon.com in the near future.
 |
| J Lynn's solution to malware |
I hope it's not going to just advocate, "install Linux and forget about malware" because, as many of us know, malware is not restricted to the Windows platform. I'm struggling to think of a current consumer computing platform that does not have at least basic malware samples available in one form or another. I'm pretty sure that IOS, Android, Linux and Mac OS X all receive their fair and generous share of security updates.
I am also pretty sure that if the majority of computer users migrated from using Microsoft operating systems to Some Other Operating System (SOOS) then we'd see a slew of SOOS malware before long. Nevertheless, the press release (emphasis and paragraphs added for clarity) continues:
"According to Lynn, Microsoft computer operating systems inadvertently grant administrative permissions to intruders in an effort to improve user experience while browsing the web. Moreover, Lynn argues that virus protection firms are well aware of these inherent flaws* and offer an endless series of costly solutions to the PC-owning public.
With this in mind, Lynn offers detailed instructions for obtaining and installing alternative operating systems. Lynn contends that this system offers far more sophisticated protections for users, is extremely inexpensive and won't require frequent and expensive updates.
This new system can be installed without removing your current operating system. Then you can choose if you want to keep your current system, replace it, duel (sic) boot both systems, or only use the new system when you want temporary protections in place for your computer before logging on to the Internet."I've not read this book. I don't know what solution Lynn is offering. I want to know and I will find out. But I predict that I will be disappointed.
* I would hope so. I pity the security firm that doesn't understand software vulnerabilities.
Sunday, 23 November 2008
The Complete Internet Security Handbook 2009
If you want to keep your family safe and your data private then The Complete Internet Security Handbook 2009 is the book for you. It includes the following:What do you want to protect?
Learn how to manage risk and provide the best protection you can for the people and things you care about the most.
Cyber-criminals
Why do viruses, hackers, spam and fake bank websites exist? Discover the criminal underworld of the internet and find out how the scammers and conmen operate.
Chapter 1: Basic Desktop Protection
Take advantage of Windows' built-in security features and protect your computer for free.
Chapter 2: Viruses
Learn how to avoid viruses, recognise them when they appear and remove infections from your computer.
Chapter 3: Hackers, spies and other criminals
Prevent the bad guys on the internet from gaining control of your computer, internet connection and personal details.
Chapter 4: Spam and how to avoid it
Is your email inbox overwhelmed with annoying messages? We'll show you how to regain control and banish spam forever.
Chapter 5: Protect your child
The internet is a great educational resource, but threats abound. Ensure your kids stay safe online with our comprehensive guide.
Chapter 6: Lost and stolen
Reduce the chances of computer theft and encrypt your files to keep them private, even if they are stolen.
Chapter 7: Accidents and malfunctions
Discover the easiest way to keep your files safe and find out how to recover them if the worst happens.
Chapter 8: Personal privacy
Learn how to prevent your personal data falling into the wrong hands.
Chapter 9: Scams, fraud and hoaxes
Learn how to protect yourself against identity theft, email hoaxes and fake websites designed to steal your money.
BONUS CHAPTER: Wireless networking
They are convenient, but how safe are wireless networks? We show you how to build and bullet-proof your network.
The Complete Internet Security Handbook 2009 is available now from Borders and costs £7.99. It will also be available in WHSmiths from 27/11/2008. Amazon is currently selling it for £6.39 (as of 23/11/2008).
ISBN: 1-906372-18-7
Cover price: £7.99
Edited and (mostly) written by Simon Edwards.
Sunday, 3 February 2008
Facebook bookazine
If you're a fan of the Facebook website you might be mainly concerned with increasing the size of your friends list, ensuring you stay up to date with what your friends are up to and sharing photos with everyone. But what about your personal privacy? How easy is it to be stalked online when you use Facebook?This book, just published by Dennis Publishing, covers the lot - including how to use Facebook effectively. Of course, my contribution to it does not involve virtually 'poking' people or playing silly pirate games. Check out the chapters on privacy and how to stay safe when using this website.
Tuesday, 27 November 2007
The Designer's Desktop Manual: Essential Technology Techniques for the Design Professional
I wrote some of this book:
"The Designer's Desktop Manual" unravels the essential technical aspects of key areas of print and screen-based design, type and typography, colour, imaging, layout, and printing, via step-by-step projects and inspirational examples. Each section will analyse the technological issues - from the most basic, introductory techniques and principles, to more advanced practices - and the skills needed to work within each area of design.
"The Designer's Desktop Manual" empowers the amateur or student designer, tackling common technical problems and establishing best-practice guidelines alongside a wealth of technical hints and tips. "The Designer's Desktop Manual" also puts the most up-to-date digital and hand-made techniques into the context of the evolution of design, allowing the design student to gain a deeper knowledge of design processes and techniques.
Buy it, and buy it now!
"The Designer's Desktop Manual" unravels the essential technical aspects of key areas of print and screen-based design, type and typography, colour, imaging, layout, and printing, via step-by-step projects and inspirational examples. Each section will analyse the technological issues - from the most basic, introductory techniques and principles, to more advanced practices - and the skills needed to work within each area of design.
"The Designer's Desktop Manual" empowers the amateur or student designer, tackling common technical problems and establishing best-practice guidelines alongside a wealth of technical hints and tips. "The Designer's Desktop Manual" also puts the most up-to-date digital and hand-made techniques into the context of the evolution of design, allowing the design student to gain a deeper knowledge of design processes and techniques.
Buy it, and buy it now!
Monday, 2 April 2007
The Ultimate Guide To Windows Vista
Now available at all good newsagents, this is the only Vista magazine you'll ever need to buy.
This useful and entertaining book/magazine is written by editors from PC Pro and Computer Shopper magazine.
Why am I blogging about this? Because I wrote the security chapters and the bits about Internet Explorer 7.
- Install Vista in minutes
- Make Windows faster
- Explore new features
- Keep safe online
- Let Vista entertain you
- Wireless networking
Subscribe to:
Posts (Atom)
