Tinys World of Technology BS

SWLAPCUG

SWLA Personal Computer Users Group

Skip to content
Advanced search

Quick links
FAQ
ACP
MCP
User avatar TinyJWRinLC
Private messages [0]
Notifications [0]

Home Portal Board index Everything Else
Post Reply
Advanced search
1 post • Page 1 of 1

User avatar
TinyJWRinLC
Site Admin
Posts: 425
Joined: Wed Feb 18, 2015 4:11 pm
Location: In Front of a Computer

Thursday, October 20, I attended the Cyber Security Awareness Workshop at Port Arthur, Texas.  This was a follow up to the Cyber Security Awareness Kickoff held earlier in the month.

There were three discussions, each lasting an hour.  All of the speakers were extremely interesting and spoke their entire allotted time.  I took a few notes each session.

1. Real Cybercrimes – Detective Brian Cater, Port Arthur Police Department.

Detective Cater spoke mostly about internet scams that were actual cases in the city.  These were mostly the same scams we hear about nearly every day: phishing, website spoofing, lottery scams, online job listings, etc.  In recent years, victims have generally been older people.  In most cases, funds are lost and never recovered.  If you are a victim, suspect a scam or want to learn more, check the Internet Crime Complaint Center website.

As he ran out of time, his final tip was to create your Social Security Account if you haven’t already.  That way, no one else can create one using your identity.

2. Social Media – Javier Barajas, IT Support, City of Port Arthur.

Mr. Barajas gave an interesting talk on using social media.  The average person uses their cell phone 4.7 hours a day.  He talked about things to watch for and gave some great examples.  My personal favorite was a young lady that posted “guess who got a new credit card” and uploaded a picture of her new card.  One of the responses to her post was from someone that asked what the cvv number on the back of the card was. You can guess what happened.

Advice:
a. Watch what you post, once on the internet, it’s always there.
b. Don’t share your location.
c. Click “like” on Facebook may result in bad things – Many of these sites are data farming.
d. Check your social app privacy settings.  An internet search can prove useful.
e. Use two-step verification when available.
f. Use different e-mail addresses/user names for different sites.
g. Don’t use selfies as your avatar.
h. Don’t enable auto login.
i. Change your passwords frequently.
j. Close old accounts.
k. Think twice before clicking on links.

3. How to Configure Your Home Network – James Cammack, Instructor at Lamar College PA.

Mr. Cammack gave a great presentation on setting up and configuring your router.  He used an excellent analogy of comparing a router to the U.S. Post Office.  One delivers web pages to your computer and the other delivers mail to your house.  Both use addresses.

Advice:
a. Use WPA2 encryption.
b. Change your router password.
c. Hide your SSID.
d. Use guest network (or disable if you don’t want to share).

Mr. Cammack only had time to finish part of his presentation.  Hopefully, he will speak again next year.

I had another great day in Port Arthur and am looking forward to attending next years events.

On October 6, I attended the 5th Annual Cyber Security Awareness Month Kickoff in Port Arthur, Texas.  There were four seminars, all free to the public.  I thought I would share a few notes and comments on my day.

1. The Internet of Things – was presented by Ira Wilsker of the Lamar Institute of technology.  He gave a presentation on the many home appliances, medical devices, security systems and other things that are all connected to the internet.  One of the many problems is that most of these things have no security and can be used as ingress points into your home network.  He also talked about how they can be used as remote bots for attacking web sites and used the recent Krebs on line site as an example.  I didn’t bother to note all the many items he talked about, but there were a few that I found interesting:

Johnson & Johnson warns insulin pumps can be hacked – many medical devices and systems are vulnerable, maybe even more so than driver less automobiles.

Connected Cattle – a farmer that has tagged all of his cattle with devices that monitor their health, feeding, etc.  It can even tell when the animals get pregnant.

IoT devices being increasingly used for DDoS attacks – a Symantec blog explaining how a Denial of Service attack works.

Sad reality: It’s cheaper to get hacked than build strong IT defenses – an excellent article by Iain Thomson that compares hacking defenses to the Ford Pinto formula.

2. NetSmartz – was presented by Detective Michael Nixon, Beaumont Police Department Special Victims Unit.  He talked about keeping safe from cyberbullying, on social media, etc.  Some notable links were:

Parents & Guardians – a section of the NetSmartz website with tips for caretakers of children.  There are also sections for educators, law enforcement, teens, tweens and kids.

CyberTipline – where you can report cyber crimes.

Suicide of Amanda Todd – a Wikipedia article about a fifteen year old girl who was cyber-bullied.  She posted a You Tube Video, and then committed suicide.

3. Security Today – was a presentation by Dell Computers and Wayport Business Solutions. They spoke about the SonicWALL Advanced Gateway Security Suite which is an advanced firewall.  They also briefly talked about Lightbeam, a web browser extension for keeping track of third party web sites that track your online activities.  (My research after the fact shows that the extension is only available for the Firefox browser.)

4. Cell Phone Forensics – was presented by Elie Van Horn of the Port Arthur Police Department.  He spoke about data found on cell phones and the methods used to find it.  He also spoke at length about how cell phones can be used to track you.  Some interesting links:

TeenSafe – an online service that can be used to put tracking software on phones.

StealthGenie – another tracking app.  My later research revealed that this app is no longer available because the creator has been jailed.

MobilStealth – still another tracking app.

So what did I learn from the seminar?  I had a passing knowledge of most of the items presented.  One thing I found the most interesting of the entire day was a website that was mentioned by the first and third speakers.  The final speaker started his presentation by stating how he was definitely going to check this site when he got home.

SHODAN, The Search Engine for the Internet of Things is exactly what it sounds like.  With it, you can search for things connected to the internet.

I really enjoyed the day and am looking forward to attending again next year.

If you read a newspaper, watch the television, surf the internet or probably even have a casual conversation on the street, you’ve probably heard someone’s opinion about the Sony data breach.  I’ve got my own impression.  Want to hear it?

HO HUM!  What’s new?  I’m not surprised.

In October of 2012, I wrote an article titled “Companies I Dislike a Lot“.  One of the companies I mentioned was Sony.  I haven’t changed my mind since then.  With the exception of watching Jeopardy and a few Sony movies, I haven’t put any of my money into their coffers.

This isn’t Sony’s first data problem.  In 2009, George Hotz (the first person to jailbreak the iPhone) announced that he was going to hack the PlayStation 3.  The following year he did so.  Sony retaliated by suing him.  They went so far as to obtain the IP addresses of everyone that visited Hotz’s website.

In response, the hacker group Anonymous sent this warning to Sony:

“Your corrupt business practices are indicative of a corporate philosophy that would deny consumers the right to use products they have paid for and rightfully own, in the manner of their choosing. Perhaps you should alert your customers to the fact that they are apparently only renting your products? In light of this assault on both rights and free expression, Anonymous, the notoriously handsome rulers of the internet, would like to inform you that you have only been ‘renting’ your web domains. Having trodden upon Anonymous’ rights, you must now be trodden on.”

About two weeks later, Anonymous launched an attack on the PlayStation Network.  They shut the network down for 23 days and obtained the personal details of about 77 million PlayStation customers.  Even with advanced warning, Sony didn’t protect their customers.  Doesn’t that seem like a company that doesn’t care?

In the next several months, there were many attacks on Sony servers.  In June of 2011, the hacker group LulzSec broke in to the Sony Pictures servers and obtained private information including passwords, email addresses, home addresses, dates of birth, etc. of over one million customers.  Why did they do it?  This was their statement.

“Our goal here is not to come across as master hackers, hence what we’re about to reveal: SonyPictures.com was owned by a very simple SQL injection, one of the most primitive and common vulnerabilities, as we should all know by now. From a single injection, we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks?“

The hackers said that all of the extremely sensitive data was easy to find and stored in plain text.  Does this sound familiar?  Compare it with the recent hack.  I’ll repeat myself, “HO HUM!  What’s new?  I’m not surprised.”

Why does Sony keep getting hacked?  I think it is for two reasons.  Sony doesn’t care about their customers.  Starting with the DRM rootkit, they have made decisions that are both legally and morally wrong.  Many of these customers are also hackers.  They get upset and retaliate.

Secondly, Sony makes it easy for hackers to hack them.  They obviously have not learned any lessons from previous attacks.  They don’t seem to have done much to fix their security problems.

When I think about the latest Sony hack, my first thought is, “Great.  I still have not forgiven them for putting a root kit on my computers.”  I do feel sorry for all of the Sony employees whose data is readily available for downloading.  They did no wrong.  Too bad that corporate thinks as little of their workers as they do of their customers.