Live Blog

The RACK59 Blog

rss

Focusing on technology, security, innovation and our community


Protect Yourself Against the DNS Changer Malware

On July 9, your Internet could mysteriously stop working. Unless you just happened to forget to pay your bill, the culprit will likely be a sneaky piece of malware that is hiding somewhere on your machine. Sound too far-fetched to be true? This isn’t another scare by the Conflicker worm, most commonly known as the malware that has been rumored to shut down systems operating on a certain day, usually April 1; CNET has verified the DNS Changer Malware to be a legitimate threat. The malware works by altering user DNS settings to redirect them to malicious websites and show them a “fake” version of the Internet. The DNS Changer Working Group (DCWG) has a website with information about how to detect, fix and protect yourself from this malware.

From the DCWG website: “The botnet operated by Rove Digital altered user DNS settings, pointing victims to malicious DNS in data centers in Estonia, New York, and Chicago. The malicious DNS servers would give fake, malicious answers, altering user searches, and promoting fake and dangerous products. Because every web search starts with DNS, the malware showed users an altered version of the Internet.”

The malware originates from cyber criminals operating under the name of Rove Digital. The criminals were arrested back in November, but the malware is still active and floating around cyberspace. Under a court order, victims have until July 9 to identify and fix infected machines before they are cut off from the Internet.

Fortunately, detecting the malware is incredibly easy and requires no scans or downloads. The DCWG website has a link users can click to check if their DNS is looking up addresses properly. If you believe your machine is infected, they also have information on how to remove the malware.


Most Common Ways Malware Compromises Security

Scamming and malware is a constant worry for Internet users. Many people use the Internet to pay bills and manage their finances. Almost every website requires a username and password to access information and keeping track of all the logins can be a hassle. Often, people will let their guard down, share information with friends, or be careless while browsing from a public location. Sometimes, even while practicing safe browsing habits, people can find themselves in a sticky situation where their accounts are compromised. There are many factors involved in staying secure. Knowing how the criminals gain access to your information can help you be more aware of common traps while surfing the web.

One of the most popular ways cybercriminals gain access to private information is by exploiting backdoor openings in browsers. It works better than any other tactic because it doesn’t require the user to willingly do anything such as click on a harmful link or download an infected file. Malicious sites are often accessed while clicking on results from a search engine. That isn’t to say that fake websites and malware-laden websites aren’t the typical fare for a crook; the most commonplace scam is the one that involves a hacker redirecting you to a website that looks identical to another and requests your login information. If you are socially network savvy, you may be aware of these types of scams since they are commonly spread as links from a hijacked account. What the hacker wants most of all is to be profitable with his craft, so it goes to figure that websites like Paypal and banking services are highly targeted.

False websites coupled with malware such as keylogging tools are bundled together to lure the victim in and steal his sensitive data. Even websites that have a multi-login process aren’t 100% secure; creative hackers have created ways around these by stealing the credentials in real time and entering them while the user is temporarily blocked from accessing his account.

The best ways to stay protected? Practice safe browsing. Safeguard your personal information. Avoid spam and suspicious links. And most importantly, scan your computer frequently.


Test Drive the Cloud: Top 6 Services with Free Storage

Sometimes, you just need to experience things first-hand. If you’ve been itching to find out what the cloud is all about, or are just in search of some free storage for your personal documents, here are several services that offer free storage to customers. These services are available cross-platform and are usually made for use between a PC and personal handheld device.

- Google Drive: The latest and most highly anticipated Google service launched at the end of last month and was met with a positive reaction. Google Drive is a basic storage service that syncs between anything on the Google cloud network, including Android devices. It’s essentially a mutation of Google Docs, but now offers more powerful collaboration tools and 5GB of free storage to customers. Users can make files available offline and have the ability to edit them directly from the interface. Upgraded storage plans are relatively cheap; 25 or 100GB of additional storage costs $2.49 or $4.99 yearly respectively.

- Dropbox: With its easy-to-use controls and accessibility across multiple platforms, Dropbox is a fan favorite for syncing and sharing files and folders. It has a very simple and limited user interface, but it’s made even more functional with add-ons such as Dropbox Folder Sync. Dropbox offers 2GB of storage to users starting out and has several ways to obtain free space, such as with referrals or camera uploads. Paid accounts are less flexible than some alternatives with the lowest plan starting at 50GB for $9.99 per year, but they also offer large storage (starting at 1TB) for groups. Paid Dropbox users can also reap the benefits of referrals to increase their storage even more.

- Microsoft Windows Live SkyDrive: This service rivals Google Drive; they recently added more functionality and improved management features. It integrates with Windows and Live users. Unfortunately, they reduced the amount of free storage offered to customers from 25GB to 7. Additional storage will run users $10 for 20GB, $25 for 50GB, or $50 for 100GB annually.

- SugarSync: As a self-proclaimed “personal cloud service,” SugarSync is similar to Dropbox except it offers 5GB of free storage to new users. It also has more complex tools for file management and sharing.

- iCloud: This is the default storage solution for Apple users and is integrated with all of their products. Users get 5GB of free storage and can upgrade to a maximum of 50GB. Paid music, books, and photos aren’t counted against the free storage limit.

- Amazon Cloud Drive: Amazon is a newcomer to the cloud scene but is catching on quickly. The service offers 5GB of free storage to users and guarantees secure storage for music, videos, photos, and documents. Paid storage plans flexible and go up to 1,000GB.

10 Reasons to Choose Cloud Services for Your Small Business

If you’re still uncertain cloud computing is right for your small business, here are the top 10 benefits that the cloud has to offer small businesses.

1. Lower costs – The cloud reduces dependency on excess hardware and software and maximizes your IT expenses. Instead of paying a flat rate for storage and data usage, you only pay for what you use.

2. Scalability – The cloud is a ubiquitous, elastic entity. It can stretch and shrink at will to fit the needs of a wide range of tasks, including application use. In times of higher traffic, the cloud scales up temporarily to suit the user’s increased needs, and shrinks when it is no longer in use.

3. Automated Updating – This takes the burden off of the shoulders of the IT guys, who will no longer need to worry about paying for expensive hardware and software upgrades.

4. Remote Access – Information is automatically synced via the Internet in a remote location. This allows anyone to access and update their information from any location as long as they are connected to the Internet.

5. Disaster Preparedness – Data is stored in external location away from the main office. In the event of natural disasters or fires, the data will always be backed up and there when you need it. Users no longer need to worry about losing important documents in the event of a power outage.

6. Ease of Use – You won’t need to depend on IT resources as much; cloud services are easy to set up and maintain. Instead, you will be able to focus your energy (and money) on areas that may need additional work.

7. Dependable Third-Party Vendors – Companies who offer cloud services are reliable and have several years of functional knowledge in the industry. They have great customer service for any concerns or problems you may have. The bottom line: you’ll be partnering with people who are qualified to handle your data.

8. Reaction Time – The cloud responds notoriously faster than physical servers.

9. Closing the Competition Gap – One of the biggest struggles a small business faces is competition from larger companies. By using cloud services, a small business is able to fight back by using the same powerful tools that top-profiting companies use. As an added bonus, you’ll only be paying a small fraction of the cost.

10. Customization – Shaping the cloud has limitless possibilities. Users have thousands of tools from various vendors directly at their fingertips. It’s a fully customizable space with endless potential.


Quick stats about the cloud

A recent infographic published by CSC illuminates the usage index for cloud computing and shared some interesting facts about how the companies reacted to switching to the cloud. These statistics are helpful when determining the benefits in adopting the cloud. Here’s the breakdown:

33% of companies moved to the cloud in order to gain access to information from multiple devices. 

Only 17% cited cutting costs as their main cause. Only 14% of companies downsized their IT departments after switching to the cloud. 20% hired more.

Savings in the cloud are visible but small. 82% of U.S. companies say they saved money by switching to the cloud, but for 35%, savings were less than $20,000. Small businesses saw the least savings. Overall, companies in Brazil saw the most savings.

Companies that switch are in it for the long haul. 65% paid for subscriptions lasting one year or longer on their first contract.

The cloud reduces waste, improves IT departments, and increases proficiency. 47% of companies said their operating costs declined while using the cloud.

Fewer employees resist cloud conversion. 74% of small businesses (50 employees or fewer) reported having no one resist the move.

25% of companies claimed to be more concerned about data security after switching to the cloud. Companies in Singapore were the most concerned about security, while 47% of companies in Brazil said they were less concerned.

The government is slowly transitioning to the cloud services, with almost half of government IT workers saying that they’ve already made the move. There is a new requirement that states U.S. federal agencies must adopt a “cloud-first” policy.

The statistics came from a global survey of 3,645 IT decision makers in 8 countries.  You can view the full infographic here.


Security actions to ask about the cloud

Cloud services are a great resource for businesses but are often lacking in security. Unfortunately, this is one area in which cloud computing desperately needs more work. The current model often forces businesses to change their current practices to suit a cloud that needs to allow open-flow access and shared services. There is no basic groundwork for encryption and security standards are not universally agreed on across the board, leaving room for problem areas to arise unexpectedly. In some cases, they can lead to sensitive data being divulged.

Until a minimum security standard can be reached, Gartner urges businesses to request detailed security reports from their cloud service providers. Here are some questions to keep in mind when choosing a cloud service provider, from a report published in Information Week:

• Does the cloud service provider require the use of two-factor authentication for the administrative control of servers, routers, switches and firewalls?

• Does it support IPsec or Secure Sockets Layer with Extended Validation certificates and two-factor authentication for connecting to the service?

• Does it contract for, or provide protection against denial-of-service attacks against its Internet presence?

• Can it demonstrate established procedures for vulnerability management, intrusion prevention, incident response, and incident escalation and investigation?

• Can it show documented identity management and help desk procedures for authenticating callers and resetting access controls, as well as for establishing and deleting accounts?

The report states that if two or more of these questions are answered with a “No” by a service provider, they should be eliminated as a reliable source if you’re planning to involve customer or other business-sensitive data. The cost of having sensitive data leaked or stolen is incredibly high and can cripple a business. Until services providers can live up to a high standard of dependability, it is recommended to be cautious about who you trust with storing sensitive information.

Instagram sets off security threat?

By now, most mobile users are aware of the threat of having their data stolen due to improper security. With infinite options to choose from and millions of apps to make our lives easier on the go, smartphones often function as a mobile extension of our work and personal lives. You may be familiar with the common methods of safeguarding your information: changing and maintaining a secure password, scanning for viruses on a scheduled basis, and not sharing personal information. Now, there’s one more thing to worry about – the SMS Trojan sparked by the sudden rise popularity of the photo sharing app Instagram.


Instagram is a photo sharing program that allows you to enhance captured photos or images saved in your smartphone’s gallery with several different filters. It gives users the option to add tags and upload the polished photos to a number of social networking sites. Instagram’s appeal is their signature vintage feel; images are formatted in a style that mimics old Polariods.Instagram has been around since 2010 and was initially available on devices running Apple’s iOS. It caught on quickly and spawned several sites and blogs that posted Instagram photos. Facebook bought the photo giant on April 3, and on April 12, an app was finally released for Android phones running version 2.2 (Froyo) or higher. Since the release of the app, the Android market has seen a surge in interest for the app. Malware watchdogs reported that several copycat Instagram websites have popped up offering “genuine” downloads of the app. These third-party installs can seriously cause harm to your phone and expose personal information.

What’s scary is that this has happened before with hyped apps, namely the Angry Birds Space unveil back in February. And while malware on Android has been limited until now, it’s clear that hackers are picking their targets wisely. The websites who have been spotted offering the Instagram app purportedly also offer a variety of popular apps and games for free. While you may have the urge to nab the paid app that you’ve been craving for free, it’s important to remember to not openly trust third-party websites claiming to offer the latest and greatest technology, especially if it is claiming to be a paid app for free or a pre-release. Official copies of the app will be sporting the company’s name on trusted markets such as Google Play and the Apple and Amazon App Stores. If you believe that you may have fallen victim to a malware scan, there are several free solutions available for your device.


The IT advantages of cloud computing

Many businesses are switching their infrastructure to a cloud-based one, and it’s clear to see why. The benefits are abundant; it gives a business more freedom and customization while freeing up valuable budget resources for more important processes. It’s not just the business that reaps the benefits from the change. IT departments have the most to gain from the conversion, and here’s why:

Simplified Model: IT organizations are mostly concerned with the costs related to maintenance and how to align their budget with the needs of the business. Implementing cloud services in their infrastructure gives the company more direct control over operating expenses (OPEX) and capital expenditure (CAPEX). Freeing up the budget for the IT department will also give them room to focus on increasing revenue and growing the company.

Appropriate Size: The cloud is not limited by spatial restrictions like typical data hosting; it can grow and shrink depending on necessity. It offers rapid deployment that enables it to quickly scale in size to meet the need of application usage and can accommodate “peak times” of increased traffic.

Ease of Integration: The cloud is flexible, secure, and has access mechanisms that make it a great option as a core platform. Many applications for use by enterprises require integration outside of the structural mainframe.

Security: Cloud services are system-based and not point-based, meaning they are secure on all levels of the infrastructure, including applications, remote networks, and software. It also supports users connecting from non-secure sources, such as from a mobile network. These safeguards protect the database on multiple levels and helps prevent gaps that hackers and get into.

Infrastructure Safeguards: One of the most vital things a business can do to protect itself is to have preparedness in case of disaster or other situations. Standard recovery systems only protect the most important applications of a business. With cloud services integration, the entire infrastructure can be protected because its scalability incorporates into data recovery.

Cloud Computing vs. SaaS

You’ve no doubt heard the terms “cloud computing” and “software as a service” tossed around almost interchangeably, so what is the difference between the two?

The term “cloud” refers to the type of Internet networking that is more of an abstraction than a physical anomaly. In early network drafts, the concept of interconnected computers was originally depicted as clouds linked together on a flowchart. The intricate system of networked computers that came to make up modern Internet eventually adopted the term “cloud computing” to describe its functionality. With early computers, users didn’t own the computer and merely rented time from a server. Many years later, users owned personal computers but had the added responsibility of keeping software up to date and had to manually backup data. Now, the two models of computing have meshed together; consumers own personal computers and devices but are also renting out server time elsewhere. Instead of relying on one server to complete tasks, we’re now drawing information from several different sources.

Any time you use a computer that is not in your physical location, it’s some form of the cloud. Most often, you use the cloud in terms of “software as a service” (SaaS), such as with online versions of applications and software like e-mail, online financing, social media, or data hosting. SaaS can either be free or require a paid subscription. With SaaS, your personal account is connected to data stored outside of your computer or device. As long as you have an Internet connection, you can access the software and information.

So, what is the difference between cloud computing and SaaS?

Pure cloud computing is distinctly different from SaaS in that you create and customize an environment to suit your needs. It is more customizable with unique opportunities for storage and content creation. With SaaS, you are restricted to the features available to you by default through the program or application, though you are able to receive software updates and can back up data automatically. As a true cloud user, you are responsible for the upkeep of applications and servers you own. The price for cloud services can also fluctuate based on usage, whereas paid SaaS subscriptions are a flat rate.

For both choices you need to trust the organization you partner with. Both cloud and SaaS users have to rely on external servers to continue operating as promised. You need to know that the company or service will continue running and have a backup plan in the event something should happen to discontinue its usage. SaaS users can run the risk of restricted functionality or service termination due to a subset of people who use the software illegally or to perform harmful actions. Companies can also change hands and be bought out; this is something that happens quite frequently. In those cases, service agreements and terms of use are subject to change.

What to Expect: Security in 2012

Computer security is often a huge game of cat and mouse – antivirus software companies are always in a race against to protect against the multitude of threats facing the public. Companies and consumers alike are constantly under siege from malware, viruses, hacking attempts, and phishing scams. If you want to be better prepared, keep a lookout for these top security trends in 2012:

Hacking and security breaches are inevitable. They happen every day, and even big companies are not immune. The problem? The large volume of attacks launched every day. Last year, Sony’s Playstation Network went down for several consecutive days and the personal information of several million customers was compromised. Businesses have accepted that it’s no longer about preventing these attacks from occurring; it’s acknowledging that it will happen and plans need to be made for how to respond. The quicker a breach is detected, the easier it is to recover.

Mobile threats are on the rise. To date, the Android OS has attracted the most attention in this area, although it’s highly ineffective since most users don’t keep financial information – the stuff that makes criminals money – on their devices. Smartphone users are essentially in the clear for now, with malware threats being not much more than a nuisance in most cases. However, it’s only a matter of time before the threats become dangerous, especially for other platforms, namely Windows Mobile OS.

Social networks are a large target. Social network attacks work because they fool the users into willingly giving out information. It’s very easy for hackers to engineer a link that will redirect a user to a website that looks identical, but fake version of a well-known website, such as Paypal or the social network itself. Unsuspecting users then enter their log in information, thus giving the hackers direct access to their information. With 800 million registered members on Facebook alone, the market for hacking attempts has
unlimited potential for criminals.

Code is constantly under scrutiny. Hackers often use known vulnerabilities in programs to launch their attack. An abundance of bugs and flaws means there are that many more openings for a hacker to gain unwanted access. Developers need to take the time to make sure their code is flawless and release updates when they’ve detected a problem.