Security Archives

In these post 9/11 days, intrusion and lack of privacy are often justified by the glib phrase “If you have nothing to hide why worry?” Yet all of us at some time or other have something to hide without being a criminal. What if you’re planning a surprise party, buying presents or arranging a secret holiday? Or perhaps you are being very naughty – hiding photos of your girlfriend from your spouse, which if not exactly nice, is not usually a crime.

The best reason of all is for personal security – ID theft is at an all time high and keeping important information secure is not that easy these days. Even if you trust your firewall, anti- spy ware, etc, what if your pc or laptop was stolen? Could you be absolutely sure that no one could read your files, or access your passwords, business accounts, salary files, and new business ideas?

What if you could hide your most cherished information so securely that it couldn’t even be detected? Well now you can, thanks to open source and it won’t even cost you a cent. All you need is a PC running Windows or Linux and the Truecrypt application.

Truecrypt is a remarkable piece of free software that can be downloaded from http://Truecrypt.org It uses the best security methods- algorithms like ES-256, Blowfish, CAST5, Serpent, Triple DES, Twofish, AES-Serpent, and AES-Twofish-Serpent. Even the source code is available to examine or alter. Don’t worry if you don’t know what these names mean; they are all well established and verified means of encrypting data. You can find out more about them on the Truecrypt website or use Google.

There is a very dodgy practice in security- known as “security through obscurity” that works by not revealing how the secured data is stored. It relies on that secrecy to protect your data. This is snake oil. Many programmers think they can write their own encryption algorithms and sell them but it is actually pretty hard to develop robust and secure algorithms. It’s considered far better to use tried and tested methods and keep your passwords secret. That’s what Truecrypt does. There is nothing wrong with hiding the files as well but you should not rely on keeping files hidden as your only means of protection.

Truecrypt is excellent at disguising its encrypted files. It doesn’t use any special type of file so the presence of a Truecrypt file cannot be easily spotted. It is possible to detect that you have used Truecrypt on a Windows PC by looking in the registry but those registry keys can be found and removed if you are really security conscious and know how to use regedit.

In Windows Explorer if you see a file ending in .txt, it is usually a text file, just as .xls is an excel file, .doc is for word etc. With a file named kernel.sys, you might think it is part of Windows. But it could equally be a Truecrypt file. Examining the bytes in a Truecrypt file with a hex editor will not reveal what the file contains or even identify it as a Truecrypt file. You’ll just see random byte values. The whole file is encrypted and only your password can decrypt it. As your password isn’t stored anywhere that means if you forget it, the data is irretrievably lost. There is no back door or recovery utility that you can use.

Unusually for software of this complexity, Truecrypt is very easy to use. It can make use of a file, an entire disk or even a USB drive to hold encrypted files. My preference is to use a file, as it’s easy to make backup copies.

Each Truecrypt file or drive is actually a “volume”, similar to a root folder that holds other files and folders. Each ‘volume’ has to be prepared once- just enter a password and it is filled with random data in a few minutes. “Volume” files can be pretty small – a few hundred kilobytes or very large- up to gigabytes. The overall size obviously depends on what you want to hold in it but as a general rule, keep it as small as you can- certainly don’t make it very big “just in case”. Big files stick out like a sore thumb. Certainly avoid using file extensions that are easy to check. You might be tempted to hide a Truecrypt file in a folder full of large spreadsheets. But Excel would not be able to load your file and that might be a clue.

The Windows folder for instance is full of large files such as win32.fts, a 16 megabyte file that is part of the Windows XP help system. Do you know how to use an fts file? I certainly don’t. So creating a Truecrypt file with an fts extension in the Windows folder is one place to hide files.

Once a file has been prepared, it just needs mounting to make it usable. Select the file, choose the drive letter it will use and enter your password. One second later you’ll have a new drive show up in Windows Explorer. This drive can be reformatted, compressed and used just like a real disk. You can copy your files on to it or work directly on it- it’s as fast as a normal disk and just as safe. How do I know? I’ve used one for over a year and have never lost any data.

Certain countries have laws – the U.K. for instance, that can force you to reveal your passwords to authority if they demand it. If you don’t, you may go to jail. However Truecrypt can provide “plausible deniability”. You can store a secret volume within a Truecrypt volume using a second password. If the first password is used, only the files in the visible part are revealed and you can claim that you have complied with the law. Unless the secret volume takes up a large amount of space, like finding a hidden room in a house, it will be impossible to detect if a secret volume is present.

Using Truecrypt is of course no excuse to avoid the usual security processes like firewalls and anti-virus. Neglect those and you might end up with a key logger on your PC that would record everything you did including your passwords.

I’ve used Truecrypt to secure a large list of website usernames and passwords. It has proved to be extremely robust and reliable. If you’ve got personal data that must be kept private – Truecrypt is one of the best ways to do it. Just don’t forget your password!

Author: David Bolton
Article Source: EzineArticles.com
Provided by: Cellphone news

Chrome is the newest browser that is available for people to use on the Internet, and the ‘next big thing’ in terms of addons and applications will be Google Chrome extensions. When Chrome was first released, it was extremely fast and had many features which Internet users had been looking for for a long time. The browser market, however, is already dominated by two major organizations – Microsoft and its Internet Explorer software and Mozilla with Firefox.

How was Google going to position itself in this already slightly saturated market? They went for optimization of their code, making what is sometimes called slow (the browser) and making it lightning fast. They realized that the everyday user online cares only for retrieving information quickly, and that boot-up speed and flexibility was a big factor for people when surfing online.

The launch of Chrome was a huge fanfare, but after a few months they were having problems breaking through the 5% level in terms of overall users. So what was the reason that people were not trying and then sticking with Chrome? The answer was customization.

Internet Explorer’s major advantage over the competition in the browser marketplace was some decidedly shady tactics that Microsoft employed over the last twenty years in terms of supplying their own browser in new installs of its operating system, Windows. This practice has since been challenged in courts around the world, and MS has been forced to pay huge amounts of money in compensation to certain companies, and indeed probably caused the bankruptcy of many, many others.

The Internet generation grew up with Windows and Internet Explorer, and it became the de facto standard software for people who knew no better. It was a huge monopoly which looked as if it would continue unchecked in perpetuity. Then Firefox was born.

Firefox began as an open-source project to create a new, better, faster browser – to try to avoid the drawbacks of a monopoly caused by Microsoft. IE was by no means perfect, and was becoming slow and susceptible to attacks by virus writers and makers who targeted the dominant brand. Firefox was supported by a huge number of organizations and people, especially tech-savvy netizens who demanded more from their product. Google itself invested in the non-profit which was developing Firefox, as well as the once-defeated Netscape organization.

Firefox flourished, and its popularity has grown more and more over the last few years as even regular Internet users have realized that there is an option to using Internet Explorer at home and in the workplace. Communities of people began working on extending the functionality of Firefox ahead of IE, and these add-ons that were written became more widely distributed until they were seen as standard by the surfing population.

When Chrome was launched, people remembered how fast Firefox was when it was first released. Many thought that Chrome would become the new alternative to IE due to this speed, but they failed to realize that the reason it was so quick was because it had a standard installation with zero add-ons and extensions. This was not a good thing for Google.

The Chromium project (who are in charge of developing both the Chrome browser and new operating system) had to adapt, and so they decided to themselves allow extensions to their browser, so that independent developers could advance the functionality of the software and users could be able to use features which they were now used to in their browser.

The first few Google Chrome extensions that were shown off were developed by Google themselves, and include some very simple add-ons as well as a couple of more complex ones. The functionality of adding a site’s RSS to your reader is seen as standard to most people, but it was unavailable until the Chrome extension was released. They also released a ‘check Google mail’ plug-in which would tell you how many messages are in your inbox, and it gives one-click access to your inbox.

The best extension that was revealed early is Bubble Translate – which allowed ‘on the fly’ translation (using Google’s translate facility) of webpages. Obviously these are just the tip of the iceberg, and there will be huge numbers of add-ons, plug-ins and extensions for Google Chrome to come in the near future. We will then see how it fares against its two, well established rivals.

Author: Sammy Till
Article Source: EzineArticles.com
Provided by: Make PCB Assembly

Currently, IE (=Internet Explorer) is the most popular Internet browser. As such, malicious hackers made it their number one target and set out to exploit its flaws. It also has the disadvantage of relying on ActiveX technology, which allows web sites to run executable programs on your PC via your browser. Although there is an improvement in security in IE7 and IE8 compared to older versions, this technology is still vulnerable.

In order to improve security you may choose to use a less popular browser such as, Mozilla’s Firefox or Google Chrome.

Both Firefox and Chrome use a different technology from Internet explorer. They both built on open source code from other platforms. Chrome browser is based on the open-source Webkit engine, which is an open-source web browser layout engine developed by the WebKit Foundation. Firefox is based on the open source Gecko engine, which is a layout engine currently developed by Mozilla Corporation.

For now the most popular alternative to Internet explorer is Firefox. I have a lot of respect to Mozilla and the open source community, but when I have tried to use Firefox 3.5 I had a frustrating experience. It has kept crashing down on me, crashing my PC along with it.

As result of this experience I have decided to give Google Chrome a chance. Google Company has stated in many occasions that Chrome browser has innovative security features.

When investigating these announcements I have noticed four major security features in Google chrome.

  1. Safe browsing software (it is also being used by Firefox browser) – Safe browsing features protect users against phishing and malware attacks. It uses a blacklist approach that gets downloaded to the user’s PC on a regular basis. How does it work? Well Google is constantly crawling the web, finding new and changed websites. During this crawling if they encounter a suspicious site that seems to be a phishing site (designed to steal personal information of unsuspecting users), it is being added to a list of suspected phishing websites. If a site contains hints to potentially malicious activity, Google tracks this site for a while and if a clear evidence of malicious activity is discovered, such as, computer viruses being downloaded and installed, it is being added to a list of suspected malware-infected websites.

    If you use Chrome browser and you have safe browsing mode enable, then Google Chrome will contact servers at Google, approximately every half hour, to download updated lists of suspected phishing and malware websites. These lists are being stored on your PC so when you surf the Web each site you browse to is being checked against these black lists locally (This is designed to offer performance). If the requested site is in the black list a warning message will appear stating that the requested site is suspected to be a phishing site or a malicious site and the user can choose to go back to safety.

    This feature seems to help the fight against malware and phishing, but there is a disadvantage. A few bloggers have raise questions about privacy implications. Bloggers have notice that every few hours when an update of the black lists is being done, two parameters are being sent to Google servers – “machineid” and “userid” – both computed information based on machine/user information. This information is sent along with a bunch of other browser information to ask Google if they should download an update. This information can be used for tracking. Google is of course obligated to privacy agreement with Internet users stating it will not use any of the personal information being collected, but would this obligation stand against a court order? I really don’t know. In short, safe browsing seems like a great security feature fighting phishing and malware attacks, but users who are passionate regarding their privacy should think twice before using it.

  2. A privacy mode (Incognito) – this feature manages privacy settings and designed to suit users who use public computers, or otherwise wish to keep their browsing habits confidential. When enabled (Click the wrench menu -> Select New incognito window menu item) Chrome browser will not remember visited pages, form and search bar entries, passwords, download List entries, cookies and cached files.You can still create bookmarks, and these will be retained when exiting incognito window.

    A similar feature exists also in Internet Explorer 8 browser and Firefox 3.5 browser. These features probably make live easier for Internet users who want to keep their surfing habits to themselves, but in the same way it helps the adults in the group it also may allow children to surf unsupervised. Internet savvy kids can easily hide their Internet activities from their parents. So it is very important for parents to understand that monitoring of their children Internet activities by viewing the browser history on the child’s PC might not work.

  3. Clear Browsing Data – There is a feature in Google chrome which allow the user to clear browsing data, such as, browsing history, downloads history, cache, cookies, saved passwords and saved form data (Click the Wrench menu -> select Clear browsing data -> Select the checkboxes for the types of information you wish to remove). This feature allows you to keep your browsing habits to yourself even if you are not using the Incognito window. Parents should be aware that similar to the Incognito mode their kids can use this feature to delete their browsing history so parents should not rely on browsing history as something that can help them get involved in their children Internet activities.
  4. Sandbox security mechanism – This feature, as I see it, is the most significant one. A sandbox is a security mechanism used to run an application in a restricted environment. Browsers are dealing with malicious attacks on a regular basis. The most popular vectors for browser attacks are HTML Rendering and JavaScript execution. The sandbox security mechanism is designed to protect the user’s PC and files against these kinds of malicious attacks. If there is an attack that exploits the browser vulnerabilities and an arbitrary code is being executed on the machine, it will be executed in an isolated environment and the user’s PC will not be harmed. This security mechanism will also prevent access to the user’s files. The sandbox mechanism itself is not a new security model; It uses the security features of Windows extensively. You should be aware that since the sandbox mechanism relies on Windows to achieve its security, it is impossible for it to protect against a flaw in the OS security model itself.

In a nutshell, these four security features seem to be helpful and contributing to a safe Internet experience, but I am not seeing any innovative new security models here. Three of these features – Safe browsing software, privacy mode and Clear Browsing Data, already exist in IE8 and Firefox 3.5, and the sandbox security mechanism can be added to IE8 and Firefox by a plugin/addon.

I think the greatest advantage of Google Chrome is that currently it is not targeted as much by malicious individuals, as IE and Firefox are. Additional advantage is in the usability factor which seems to be in my opinion better than IE or Firefox, but I think this issue is a matter of taste…

For now, if you are looking for a less targeted browser, Google Chrome seems to be a good alternative.

Author: Sara Moses
Article Source: EzineArticles.com
Provided by: Benefits of electric pressure cooker

Installation and Usage:

1. You can download directly to the vendor’s website (link download will appear in the bottom of this article) and choose the Operating System you have used. I am using OS SUSE Linux 11.0. For speed installation, I choose RPM package file Linux i386.

2. After downloading these files, click testdisk-6.10-1.i386.rpm and type your password as a root user, you can wait while the installation is in process. To check the testdisk has been installed or not, just type ‘rpm -qa | grep testdisk‘ (without quote) in the console window. TestDisk-6.10-1 has been successfully installed.

3. Still in Console window, login as a root and type ‘su‘ (without quote) then type your root password, type ‘testdisk‘ (without quote). TestDisk 6.10 Data Recovery Utility will run. Press Enter.

4. Testdisk will detect your storage media/hard drive include my flashdisk Kingston DT Mini Slim. In this case I want to recover my files which have been deleted from my Flashdisk. Choose media using the Arrow keys on your keyboard, then press Enter.

5. Choose the partition type, I choose Intel.

6. Choose Analyse, then press Enter.

7. Choose Quick Search, then press Enter.

8. Type ‘Y‘ (without quote)

9. Press Enter.

10. Type ‘P‘ (without quote) to List/Preview Files

11. You can see, there are 2 different color text in the Console window, Red and White text, the red text is mean the deleted files (which will be restored soon) and the white text is mean the currently files. Type ‘h‘ (without quote) to hide the red text if you want.

12. Select the files you want to restore then press ‘c‘ (without quote) to copy it, and choose the destination of files you want to copy it to, using Arrow keys, then press ‘y‘ (without quote) to confirm the copy process.

13. To copy another files you can select the files and press ‘c‘ (without quote) again, this process is absolutely simple, it’s not difficult. 14. Well done, you have recovered/restored your deleted files.

Note: The usage of Testdisk is not limited for recovery deleted files only. According to the vendor’s website, you can use this tool to repairing harddisk which have bad sector, repairing hard disk which can not boot or bootable, etc. I hope in the next article I will try to explore the usage of this tool more deeper than before.

Author: Harun Abdurrazaq
Article Source: EzineArticles.com
Provided by: Bumper guardian