New Technology Reviews!.: Understanding

Spyware - Understanding and Addressing the Risks

"Spyware" is no longer simply a nuisance to enterprises. It is estimated that 90% of desktop PCs are infected with some form of "Spyware" (Source : US National Cyber Security Alliance). According to Gartner between 20 and 40% of enterprise helpdesk calls are now related to unwanted "Spyware" programs.There are different classes or types of "Spyware". These are summarised below. · Tracking Cookies. Cookies are text files saved by the browser that allow tracking of user activity on a website. Users typically allow cookies as some sites won't work without them or they are useful in that they store information about personal preferences, IP addresses, login information, user options and date and time stamp of the last time the site was visited. Cookies may also contain any information provided by a user during a particular visit - including any personal information provided in the course of completing forms. Cookies are at the most benign end of the "Spyware" spectrum.· Adware. This form of "Spyware" is responsible for generating the by now familiar pop-up, pop-under, banner, floating and animated advertising seen whilst surfing the web. Adware typically uses advanced scripting that manipulates the browser by exploiting flaws in Java, ActiveX, the operating system and the browser itself. Adware may collect information for cookies and report information directly to sites on the Internet. On clicking-through ads additional cookies or utilities may be installed silently. Some adware makes changes to browser settings - resetting the homepage for example - or to the user system (including Windows registry changes). Often clicking on 'No' or 'Cancel' buttons within the advert result in the same code executing as if the user had clicked on 'Yes' or 'OK'. Adware is the greyest area of "Spyware" - some Adware certainly should be considered as malicious 'malware'.· Scumware. Scumware modifies the contents of a web page adding hypertext links and alternative text. Scumware can also position competitive ads over the originals. Scumware can also install hidden or background processes and services and should therefore be considered as malware.· Malware. Originally malware referred to viruses, worms and Trojan horses. The term also applies to the more disruptive forms of "Spyware". Such programs might enable third parties to take control of microphones and web cams installed on a particular client, make changes to browser and systems settings, launch Web activity even when all browser sessions are shut down, install hidden or background processes and services. Keyloggers fall into this category. Malware is the most damaging of all types of "Spyware" from a risk perspective. It should be noted that this form of "Spyware" is increasingly being spread through Instant Messaging applications.1.1 Different Variants, Different Risks The different types of "Spyware" present different risks to enterprises. Cookies raise privacy concerns but are relatively low risk.Adware can begin to impact heavily on productivity. Orthus are aware of several instances where close to 200 different pieces of Adware were present on a single client degrading performance to the point where the client was unusable. In addition to user productivity, productivity is affected through increased help desk calls and the time spent by help desk staff in cleaning up or re-building infected machines - which in turn further impacts user productivity whilst the infected machines are unavailable.The risk of data leakage - of both personal and corporate information - is a very real threat with the most malicious type of "Spyware".Mitigating the Risk The main technologies available to mitigate against the risks associated with "Spyware" within the enterprise environment are discussed below.Mitigation techniques are two-tiered or two-part - at the gateway and at the desktop level.Desktop Protection At the desktop or client there are notably three technologies available to mitigate against the risks posed by "Spyware". These are personal firewalls, dedicated anti-spyware programs, and traditional desktop anti-virus (AV) tools.AV In some respects forms of "Spyware" strongly resemble viruses. They are uniquely identifiable, can be detected by scanning the client machine and are sometimes packaged as a set of files that can be removed to clean up the infected system. However many forms of "Spyware" do not reside on disk as persistent files - such as hostile ActiveX and Java applets. The motives, delivery mechanisms and often the removal of "Spyware" is different however from the protocols followed for viruses and worms."Spyware" is also different in that there is no one definition agreed on what constitutes "Spyware". Some programs that might be classed as "Spyware" - such as Microsoft's Windows Update Notifications - are useful, disclose their tracking capabilities, do not disrupt desktop operation impacting user productivity, and are distributed by responsible companies. "Spyware" therefore needs to be classified and identified by the actions it performs and the level of risk - complicating detection and removal, as the users must be given a choice over what is permitted. AV vendors - notably Trend Micro, McAfee and Symantec - already have software that is very good at scanning files before they execute. The software also has mature enterprise management suites and the vendors have support teams in place to handle enterprise customers' needs.Independent reviews and tests show repeatedly that AV tools are not as good at catching "Spyware" as dedicated anti-spyware programs. Whilst AV tools may detect 99% of viruses this number falls considerably to perhaps 70% - when considering "Spyware" programs.Using the next releases of desktop AV tools to protect desktops against "Spyware" is extremely attractive to enterprises. There is no need to deploy yet another software agent on every machine within the desktop population, there is no need to monitor yet another 'console'. AV already incorporates the management features that enterprises require - such as 'headless operation' and centralised reporting. Enterprises achieve greater consistency with standardisation on a smaller number of vendors, leading ultimately to cost efficiencies.Dedicated Anti-Spyware Programs There is an ever-increasing list of dedicated anti-spyware programs available from vendors including Ad-Aware from LavaSoft which is the most popular product with some 128 million downloads to date. Other notable products include SpyBot Search and Destroy, CounterSpy and Spyware Eliminator. Microsoft has also entered the market with Windows Antispyware following their acquisition of Giant Company Software.Whilst dedicated anti-spyware programs are more effective today at detecting and removing Spyware than AV products this will change over the forthcoming quarters. Most of the dedicated anti-spyware offerings are available as free downloads aimed at consumers / individual users and not at large enterprises. Site licensing is rarely available for example. Some of the emerging vendors have enterprise offerings on their roadmaps. However these companies are small, lack corporate / financial stability in some cases, and typically do not have the support teams and infrastructure in place to handle large enterprise customers.Orthus are of the view that many standalone dedicated anti-spyware programs will cease to exist in the relatively near future and the dedicated anti-spyware market will not be significant in years to come as established vendors offer integrated AV/anti-spyware/personal firewall products.Personal Firewalls Just as AV tools now include some "Spyware" protection so many of the personal firewalls available offer a level of protection as well. These include McAfee, Check Point and Internet Security Systems (ISS) with the release of Proventia Desktop in March 2005. Sygate is following a similar path to Check Point and ISS.Personal firewalls are recommended for particularly mobile clients that are regularly taken outside of the corporate perimeter and used to access corporate systems from DSL connections in the home and public WLAN hotspots, where typically direct Internet access is also allowed. They are also recommended for fixed desktop and mobile clients in smaller locations where there is little or no gateway level protection in place and where again direct Internet access is available from those locations.Gateway Protection Desktop protection is only half of the story when it comes to "Spyware" protection. Gateway level protection is also available.Blue Coat offer a range of proxy appliances that, in conjunction with popular URL filtering solutions, offer a strong defence against "Spyware". "Spyware" often secretly installs via "drive-by" installers, which install "Spyware" in the background without any user interaction. Blue Coat combats this with anti-spyware policy controls that inspect, filter and block web content associated with "Spyware" installation software. This preventive approach is critical when "Spyware" originates from an unknown web site - not yet categorised within URL filtering solutions - and when there is no known signature available to detect the malicious program.Gateway protection incorporating a strong URL filtering solution is particularly good in preventing programs on infected systems from sending information back to "Spyware" sites, mitigating against the productivity impact of Adware but also the more serious privacy and data leakage concerns associated with more malicious code. URL filtering solutions also offer some protection from infection in the first place by preventing users from visiting known infected sites.Gateway solutions typically incorporate logging and reporting features that can be used to identify infected systems thus facilitating a targeted "Spyware" clean-up periodically. This capability is also useful to target mobile clients (notebook PCs) that are not protected with Personal Firewalls that become infected whilst outside the corporate perimeter.Recommendations In light of the above Orthus suggest that enterprises take the following approach to mitigating the risks posed by "Spyware" today :* deploy gateway "Spyware" protection to prevent back-channel communication by infected systems augmented with a leading URL filtering solution.* use granular reporting capabilities from gateway solutions to identify infected systems and choose a dedicated anti-spyware tool to clean-up infected systems on a case-by-case / ad hoc basis.* do not deploy dedicated anti-spyware programs across the desktop population - instead wait for AV vendors to add strong anti-spyware capabilities in future releases.* force remote office branch office based systems to access the Internet via the corporate gateway (where gateway anti-spyware protection exists).* for remote and mobile clients, in addition to AV, install a recognised personal firewall to increase protection.	 	 		 			 				 					 						Penny Reyes is an analyst at Orthus limited (<a href="http://www.orthus.com" target="_new">http://www.orthus.com</a>). Orthus is a leading provider of information risk professional services, helping orgnisations globally to measure, minimise and manage the information risks they face. Orthus provide end to end services for clients to comprehensivly address risk in their environments including Insider Threats, addressing issues including data leakage, sabotage and fraud; External Threats (<a href="http://www.orthus.com/dr_overview.htm" target="_new">http://www.orthus.com/dr_overview.htm</a>) including wireless security, penetration testing, virtualisation security, vulnerability management and Secure Software Development Life-Cycle; Supply Chain Threats including securing cloud services and data processed by third parties; and Legal and Regulatory challenges including Payment Card Industry (PCI) Data Security Standard (DSS).

Spyware - Understanding and Addressing the Risks

"Spyware" is no longer simply a nuisance to enterprises. It is estimated that 90% of desktop PCs are infected with some form of...

Understanding, Translating, and Using Those E-mail Headers

Technology has made it possible for families to stay in touch with the simple click of a button, for best friends to exchange pictures of the new baby, and for people to make new friends or loves without ever leaving the security and confines of their home. E-mail is often the mode of interaction and with the popularity of the internet at an all time high, e-mail has quickly become a popular new mode of communication between people.Unfortunately, this means that not only the communication you want is going to be sent to your inbox. In fact, laws have been put into place to keep you from receiving and being bombarded by unwanted and/or unsolicited e-mails. This is popularly referred to as SPAM. While the majority of SPAM is simply unwanted advertisements, on occasion, SPAM can contain malicious and/or harmful pieces of coding that can literally shut your computer down permanently.If you are the recipient of SPAM, or simply want to know who is sending you messages, knowing how to decipher e-mail headers can be beneficial information. Understanding the e-mail process is the first step to recognizing, understanding, and interpreting e-mail headers.Let's consider this example using two fictitious characters, Ralph using the e-mail address ralphATtugood.com (we've substituted the @ symbol throughout this article with the word AT so as not to have live email links to these fictitious addresses) and Suzy using the e-mail address suzyATgoodvibe.com. Ralph is using dial-up offered by Tu Good, Inc. and Suzy is using DSL offered by Good Vibe, Corp. Additionally, Ralph is using his new e-mail client to compose, send, and receive e-mail called Tu Good Connection while Suzy is using GoodVibe Connection for her e-mail client.When Ralph wants to send a message to Suzy, he creates and sends the message; the message is first passed from his computer to Tu Good, Inc.'s mail server, mail.tugood.com. Then mail.tugood.com contacts Suzy's e-mail server called mail.goodvibe.com. The message from Ralph is now stored at mail.goodvibe.com waiting for Suzy to check her e-mail. Suzy then downloads the message onto her computer to read and/or store the message.There is a lot of information you can get from the headers. With an average e-mail having a minimum of four stops, each stop adds its own bit of information. Let's watch to see what each computer adds to the e-mail header!<blockquote>Ralph sends an e-mail to Suzy. The message leaves Ralph's computer and lands at his mail server mail.tugood.com:</blockquote> <blockquote> From: ralph@tugood.com (Ralph T. Good)To: <a href="mailto:suzy@goodvibe.com">suzy@goodvibe.com</a>Date: Sun, Nov 18 2007 12:22:29 PSTX-Mailer: TuGood Connection v2.20Subject: How are you today? </blockquote> Now, mail.tugood.com transmits the e-mail to mail.goodvibe.com:Received: from alpha.tugood.com (alpha.tugood.com [122.210.4.10]) by mail.tugood.com (9.1.1) id 809h7y; Sun, Nov 18 2007 12:22:34 -0800 (PST)tugood.com (Ralph T. Good)From: ralphATTo: suzyATgoodvibe.comDate: Sun, Nov 18 2007 12:22:29 PSTMessage-ID:X-Mailer: TuGood Connection v2.20Subject: How are you today?Finally, the mail server for Good Vibe stores the message awaiting for Suzy to retrieve her message:Received: from mail.tugood.com (mail.tugood.edu [122.210.14.102]) by mail.goodvibe.com (9.1.1//8.3.2) with ESMTP id CAB9887 for ; Sun, Nov 18 2007 12:27:12 -0800 PSTReceived: from alpha.tugood.com (alpha.tugood.com [122.210.4.10]) by mail.tugood.com (9.1.1) id 809h7y; Sun, Nov 18 2007 12:22:34 -0800 (PST)From: ralphATtugood.com (Ralph T. Good)To: suzyATgoodvibe.comDate: Sun, Nov 18 2007 12:22:29 PSTMessage-ID:X-Mailer: TuGood Connection v2.20Subject: How are you today?What does all of this mean to you? Understanding what the e-mail headers says is the best way to interrupt who the message is from, when it was sent, and how to find those bothersome and irritating people sending you unsolicited messages and/or viruses. Let's investigate what all this means line-by-line.Received: from mail.tugood.comThis e-mail message was sent from a computer or other machine with the name of mail.tugood.com ...(alpha.tugood.com [122.210.4.10])... and the name alpha.tugood.com is correctly identified. The IP address of the sender was 122.210.4.10.A quick note on IP addresses!<blockquote> Internet Protocol (IP) address is something unique at that time to the sender. Electronic devices, such as a computer, use IP addresses to identify and actually communicate with one another on the network. The uniqueness of the number will be dictated by the internet service provider as well as the local networking setup. IP addresses can be one method of narrowing down where a message originates, and sometimes, an IP address can tell you the exact computer that sent the message.</blockquote> by mail.goodvibe.com (9.1.1//8.3.2) with ESMTPThe receiving machine was mail.goodvibe.com using a mail receiving host running sendmail with a version of 9.1.1/8.3.2.id CAB9887 for suzyATgoodvibe.comThis ID number is assigned by the receiving machine, and is unique to this particular message. The intended use of an ID number is for an administrator to look through the log files to retrieve information about the message. For instance, when the message was sent, and more information about the machine sending the message.The <a href="mailto:suzy@goodvibe.com">suzy@goodvibe.com</a> is the address of the person or company intended to receive the message.Sun, Nov 18 2007 12:27:12 -0800 PSTThis particular transaction occurred on Sunday, November 18, 2007, at 12:27:12 Pacific Standard Time, and 8 hours behind the popular Greenwich Mean Time.Received: from alpha.tugood.com (alpha.tugood.com [122.210.4.10]) by mail.tugood.com (9.1.1) id 809h7y; Sun, Nov 18 2007 12:22:34 -0800 (PST)When you see this, you are being informed of which computer or machine sent the original message as well as the various stops along the way. The time of transmission, the IP address of the sender, the ID number of the message, and even the mail server program being used. There is a world of information in the e-mail headers.From: ralphATtugood.com (Ralph T. Good)The e-mail header gives the receiver's e-mail address as well as the given real name of Ralph T. Good.To: suzyATgoodvibe.comThis is to whom the e-mail message was addressed.<blockquote> Note: One good method of telling if you are on a SPAM list, or being e-mailed inappropriately, is if you do not see your own e-mail address in this part of the header. Instead, you may see a long list of recipients, or an address that does not belong to you, or even, no header at all!</blockquote> We have addressed the basics of an e-mail header. There are other components which may be added to an e-mail header such as "Errors-to", "Content-Type", and/or "BCC/CC". All of these headers are an intricate part of the whole e-mail message offering insights to who is sending the message, where the message has stopped, and who is the intended recipient.When you receive the message, chances are good you will not see the full e-mail header. You will need to do a bit of research on how to read the e-mail header for your e-mail client.For instance, if you are using the popular Microsoft Outlook, you would right click on the message while it is in your "inbox". Then, you would choose "Options" from the pop-up menu. Finally, investigate "Internet Headers" in the resulting dialog box.Popular free e-mail clients such as Hotmail, G-mail, Yahoo Mail, and AOL Mail will have their out standards and instructions for looking at the entire e-mail header.There are many IP address locators on the internet today. Simply typing in the IP address and tapping the "enter" button brings up information associated with the IP address. However, it must be stated that there are false IP addresses that may be coincidental or purposeful. Many spammers will utilize IP spoofing tools that will cloak the real IP address while placing in a false IP address.Additionally, not all IP addresses are static, or remain the same. More and more IP addresses are dynamic, or constantly changing. Sometimes, this dynamic address changes continuously, and sometimes, this dynamic address will change at regular intervals such as once a week or once a month.There are steps you can take to protect yourself from unwanted viruses or hacks to your computer. For instance, do not name your computer something obvious. Look at this example:Received: from tomscompaq (22-122-31-23.abc.net [22.11.22.11]) by tugood.com (8.8.5) id TAA8997; Sun, 18 Nov 2004 18:44:22 -0600 (MDT)The IP address of the computer is easy to see, but the real problem is the computer's name is right there! We can assume that the person's name is Tom and he is using a Compaq computer. This when coupled with the IP address is going to make it extremely easy for unscrupulous people to use this information to illegally enter the computer.Remember: Use a unique and different name for your computer!The IP address, as well as other information, found in the e-mail header of the next SPAM message you receive may just help you put a stop to the unwanted e-mail. You have the tools to put a stop to those unsolicited e-mails. Consider contacting the internet service provider, <a href="https://www.a1peoplesearch.com/Searches.aspx?search=reverse-email-search" rel="nofollow" target="_new">track down the original sender</a>, and protect your privacy and rights.In addition, stay safe by being aware of the information you are sending with each e-mail message. As a test, send yourself an e-mail message, and investigate the information you are giving out with each innocent e-mail message you send.Knowledge is power; stay empowered!	 	 		 			 				 					 						ABOUT THE AUTHOR: Patrick Baird is a Licensed Private Investigator and a recognized authority in the industry. He is co-founder of <a href="http://www.a1peoplesearch.com" target="_new">www.a1peoplesearch.com</a> which provides a wealth of informative articles and resources on everything you would need to know about the people search industry and public records retrieval.If you are receiving unwanted emails and would like to learn more about who sent them we invite you to visit our Reverse Email Search.

Understanding, Translating, and Using Those E-mail Headers

Technology has made it possible for families to stay in touch with the simple click of a button, for best friends to exchange pictures of...

Understanding the Basics of Troubleshooting

If you have problems with your computer performing normal processes, or it seems to work excessively slower than it should, there are unfortunately far too many reasons for why this could be to just blame it on one thing. Many times, computer speed or performance, especially when you are connected to the Internet, is dependent upon a dozen components to work efficiently. In order to understand how to fix or improve your computer, you have to understand how your computer works. One important aspect of computer efficiency is the relationship between hardware and software.Hardware is the actual physical components of your computer, like your keyboard, mouse, and the monitor. Not only should you understand what these components are, it is also very helpful to know what each part does in relationship to the others. The specifications, or specs, of internal hardware, like your hard drive and RAM, are also helpful to know, as they can help you understand their capacities and capabilities.Software is the digital data that enables hardware to perform user tasks, like Microsoft Word and Internet Explorer. There are hundreds of software programs and system software (built in commands and controls in your computer) that perform many different tasks-like audio and visual features, or functional features for creating or organizing projects. It's important to know what software you need to not only be compatible with, but also optimize the efficiency of your hardware. You also need to know what version of your software you have, as an outdated version can severely inhibit your ability to keep up with computer (and especially online) activities.Here's how it works:1. Without hardware, saoftware would not exist. If, for example, there were no modems, there would be no software for the Internet.2. Without software, hardware would be useless. Everything your computer does, even powering on, is run by some type of software.3. Hardware and software cannot work together unless it was made to work together. Just like Ford parts won't make a Chevy work, or trying to use parts from a previous model won't work with newer cars, most software must be run on a machine that was built for it.4. Hardware occasionally needs to be upgraded. Most computers today, even the cheapest ones, have hardware that more than a hundred times faster and better than the best and most expensive computers of 10 years ago. Hardware that is too old will not be compatible with new software, or will not be able to keep up and make your computer slower.5. Software needs to be upgraded. There are constantly newer releases of all kinds of software to make use of the improved capacity and speed of hardware upgrades, as well as to be compatible with other computers and new Internet applications and features. Even with a new computer, outdated software will cause slow performance and could keep you from enjoying modern technological achievements both online and offline.Understanding the relationship of software and hardware, and knowing which ones you have is the first step in keeping your computer in good shape and running order.	 	 		 			 				 					 						Copper.net is an all-American owned and operated provider of <a href="http://www.copper.net/DSL/Service/Maryland" target="_new">Maryland DSL</a>. Call today, 1-800-336-3318 or sign up online. More online tips and news can be found at <a href="http://www.copper.net/wire" target="_new">http://www.copper.net/wire</a>

Understanding the Basics of Troubleshooting

If you have problems with your computer performing normal processes, or it seems to work excessively slower than it should, there are unf...

Understanding How Firewalls Protect Your Computer

Not many of us intentionally leave our cars unlocked or the front of our homes open to strangers. But we often leave our computers wide open to anyone and everyone that may want to snoop.To get and keep our computers safe from hackers,or anyone wanting to have a look in our computers,we need the aid and assistance of something commonly called Firewalls.A Firewall can be hardware or software that acts as a gatekeeper to your computer.It does this by monitoring all internet traffic coming in and going out of our computers.They not only allow the passage of this traffic but inspects all,making sure it is safe and do not contain viruses,any spyware,or other malicious software.Firewalls control internet traffic in two methods,Packet filtering and stateful inspection.A Packet is a chunk of data and it contains the address of the computer it comes from and a destination address.Ok,so you're wondering what on earth is an IP Address.Well,it is an identifier for your computer device.The format of an IP address is a 32-bit numeric address written as four numbers separated by periods. If the Firewall recognizes the Packet and its IP Address,or its Internet Protocol Address,it allows the Packet to pass. The Stateful Inspection method look at the some data in the Packet and compares key chunks of data to a large area that contains known,trusted information.to see if it is safe or if your computer is expecting the data.It also allow safe passage of data if all seems well.The Stateful Inspection method is preferred since it checks the data that have passed through your computer before. What About Those Hardware Firewalls Hardware Firewalls are devices that are designed to run software Firewalls.So why are there hardware firewalls,you ask.One big advantage of having a Hardware Firewall is that the computer don't have to do any work. The hardware running the software does all work,thereby leaving the CPU in the computer free to get on with other tasks.The CPU,or Central Processing Unit should be free as much as possible to keep the computer running at peak performance.Explaining The Software FirewallsThere are many creative ways that people use to access or abuse your computer when its not protected. Someone is able to connect to your computer and control it in some form. This can range from being able to view or access your files to actually running programs on your computer. Some of the software Firewalls protect your computer from are the following. Email Bombs.Someone sends you the same e-mail hundreds or thousands of times until your e-mail system cannot accept any more messages. If you spend time on the internet often you will most likely experience this. Viruses. This is no doubt the most well known threat.A Virus is a small file which reproduces itself on other computers.Viruses may be harmless to wiping your hard drive clean. Firewalls may not protect you from all viruses.It would be worth your while to invest in good anti virus software as added protection.Once you invest in a Firewall,study its owner's manual to set it up. Once the Firewall has been installed and setup complete,take a minute to be sure its working.Test the Firewall by going online and visiting a security site.Go to [http://www.grc.com] and give their free Shields Up security test a try. If the Firewall pass,you will have the comfort of knowing your PC will have that added protection from someone stealing your credit card information or any valuable information. If you have not invested in a Firewall,won't wait to give one a try.Your critical files and programs will be much safer and you will have the knowledge of being able to install Firewalls on the PC of your friends,enemies,and everyone else in between. Keep your computer safe from hackers and other intruders by fully understanding how firewalls operate in the background of your computer.	 	 		 			 				 					 						Otis F. Cooper is solely dedicated to boosting the knowledge and confidence of every computer user. Sign up to receive his informative articles every month and learn PC Repair absolutely free.Sign up now and watch detailed, in depth pc repair videos on cdroms and dvds.See sample videos at <a href="http://www.ultimatepcrepair.com" target="_new">http://www.ultimatepcrepair.com</a>

Understanding How Firewalls Protect Your Computer

Not many of us intentionally leave our cars unlocked or the front of our homes open to strangers. But we often leave our computers wide ...