Computer Humor

Beware of Fake Anti-Virus Software

It's an unwritten rule that you never need anti-virus software until you need it badly. The corollary to that edict is that, being signature based, AV programs are only as good as what they already know, and studies have shown that leading anti-malware offerings fail to detect upwards of 50% of malicious code.

If that isn't enough to make you ponder an existence as an internet hermit, then perhaps the concept of fake anti-virus software will push you over the edge.

Researchers are reporting that increasingly, users are tricked by web site pop-ups and bogus warnings of virus infection detections followed by "suggestions" to download readily-available virus removal programs that are themselves malicious code. Once the user willingly runs the program, their machine is immediately compromised and often proceeds to download additional malcode in the background.

What can you do to protect yourself? Here are a couple of key things to remember.

1. Never, ever install a program or run a command unless you are absolutely certain of its source.
2. Ignore pop-ups, warning banners, and browser redirects. Trust me - the Internet is not one big loving community that exists to help you out. Rely only on warnings from programs you've installed yourself.
3. Always have a rescue CD available for virus removal, and don't be shy about using it if you're concerned. Brian Krebs has an excellent post on finding and using rescue CDs at his Krebs on Security blog.
4. Move off of Internet Explorer. I recommend Firefox with the NoScript add-on, but Google Chrome or Opera are other good options.
5. Keep your computer patched. If you're running Windows, enable automatic updates, and use a free product like Secunia PSI to help keep track of updates to popular applications like Adobe Reader, Sun Java, QuickTime, and other frequently overlooked programs.

Let's be careful out there.

How I Met Your Motherboard

Pretty funny, and a tad bittersweet.

I fondly recall my Commodore VIC-20 and my Packard-Bell 386 - with its 40 meg hard drive and 1 meg of RAM, all for nearly the same price I paid for my 1984 Ford Escort.

Good times. Good times.


How I Met Your Motherboard

SANS - Social Engineering Computer Attacks

SANS has a timely diary entry on their Internet Storm Center page entitled Social Engineering in Real-World Computer Attacks in which they posit the following:

Why bother breaking down the door if you can simply ask to be let in? Social engineering works, both during penetration testing and as part of real-world attacks. This note explores how attackers are using social engineering to compromise computer defenses.

For all the millions spent on hardening systems and networks, there's always someone volunteering to open the door to allow attackers inside. Defense-in-depth as a strategy only works if the control mechanisms are left in place and not circumvented.

Would you install an alarm system in your house and write the passcode on the outside wall? Or would you give the code to someone who called or emailed you, claiming to be from the alarm company demanding that you validate your code for them or they would cut off your access?

Most people would answer "no" to those two questions, but history has shown that there's a real problem with people responding to phishing and vishing schemes and giving out their credentials willy-nilly. Look at some of the examples pointed out by SANS:

• Bogus parking violation notices on cars directing people to visit a web site to resolve that turns out to be a malicious site
• Voicemails left for customers to "call back" and verify their banking information
• People plugging in USB drives or CDs left in public places or sent via the mail or post

Firms that have your credentials should never be asking you to validate your credentials. Your bank doesn't need your account number, PIN, mother's maiden name, or answer to your secret question, because your bank already has that information.

Remember how your mom told you not to pick things up off of the ground and eat them because she didn't know where it came from? Yes? Then why would you pick up a USB drive or CD and stick it in your computer?

Never, ever give out information or data based on a phone call, message, or email you've received. Always contact firms and companies, such as banks, credit card companies, retailers, etc., using the contact information in your statements or using the "Contact Us" information that's posted on their official web site, which does not include following links that come via email or text messages.

There's an popular adage that you can't cure stupid. When it comes to computer attacks, the level of sophistication is increasing exponentially, so it's no longer a question of being smart. Attackers are targeting human nature, and that's a difficult challenge to overcome.

Image via Wikimedia Commons

Trick Your Friends With A USB Plugin

I long ago graduated from simple computer pranks like removing the rubber ball from someone's mouse, taking a screenshot of their desktop and making it their wallpaper, or remapping their keyboard.

As a security professional, I can't condone any device that plugs in to someone's machine, since similar devices could be configured to capture keystrokes or possibly introduce malware. That said, while I don't condone the USB Computer Prankster, I can certainly understand it.

It would be highly amusing to watch a favored target grow increasingly agitated as the caps lock randomly activated, the mouse cursor zoomed aimlessly around the screen, and assorted characters started popping up before their very eyes.

Via Dvice

Spin That Old School Vinyl With USB Style

So you have a waxy stack of Journey records, or perhaps some Bananarama. A fan of REO Speedwagon and Def Leppard, but no turntable on which to spin your old school vinyl?

Worry not, you party animal. The Linos USB record player is here.

There's no mention of the sound quality, so take this whole thing with a grain of audiophile salt. I'm not sure this device is marketed toward hardcore sound enthusiasts in the first place.

I went to high school with a guy whose senior yearbook snippet included the concept that distortion was worse than death. So there's that.

Laptop Burka

There have been some stupid products marketed to computer users over the years.

Now there is one more.

The laptop burka allows you to hide the shame and humiliation that comes with sitting outdoors with a sheet over your head while you type away on your Dell.

In case you're wondering, yes, it would get very hot under there. Instead of a Dell, perhaps you should invest in a Panasonic ToughBook in case multiple drops of sweat fly off your nose like tiny liquid ski jumpers headed for your keyboard.

As Scott Adams said, “There's nothing more dangerous than a resourceful idiot.”

Via Dvice

Hierarchy of Digital Distractions

Click the image for a larger view.

Via BoingBoing

Pillow Laptop

I've been accused of spending so much time blogging that I should have one of these, so when I pass out from weariness I don't bonk my head on the sharp corner of my Dell.

Judging by the screen resolution of this thing, it looks like in runs Ubuntu 7.04, as part of an upgrade from Windows 3.1.

Via Geekologie - Pillow Laptop: Working Never Felt So Zzzzz

Sugar on a Stick Learning Platform

Ars Technica has an in-depth look at a new version of the Sugar Learning Platform that can boot from a 1GB USB drive - hence the "stick".

The software environment was originally built for the One Laptop Per Child initiative for the XO laptop. It's a really kid-friendly computing interface pre-loaded with scores of education-related applications.

These drives could be distributed, and then children could plug them into whatever desktop computers were available at their location and enjoy their learning experience without regard to the hardware configuration.

Since the USB drive can save the user's data, the drive (and the learner's activity) would be portable, allowing the child to use it with any computer. What a great concept.

First taste: Sugar on a Stick learning platform