Top 10 Android Mobile Security Apps

While 2011 was the year of the hacktivist, it looks like 2012 will be the year of mobile malware with Android users in particular facing the reality that their device may not be as secure as they'd like to think.
F-Secure, McAfee, Trend Micro and pretty much every other security vendor under the sun have reported seeing a massive boom in the number of attacks targeting smartphone devices.
Indeed, McAfee reported that Android malware has rocketed by a staggering 1,200 per cent in the last year as the platform continues to attract the attention of cyber criminals.
There's plenty of vendors out there seeking to capitalise on the boom, with hundreds of anti-virus and security services flooding the market claiming to make your device as secure and safe as possible. However, with so much choice knowing which one to pick can be tough.
But fear not as V3's here to help. We've drawn up a list detailing the ins and outs of the 10 best mobile security apps currently available for Android smartphones to keep your beloved device free from the claws of cyber criminals.
10. Super Security: Free

Super Security is a free cloud-based antivirus app that adds a "strongbox" storage area to the device. The strongbox is a storage area on the phone that lets users password protect three different folders: Pictures, Videos and SMS.
As well as the strongbox, the service also boasts the standard virus scan, app manager, task manager and phone finder features seen on most other security apps.
As a free service, though, the features aren't as good as certain other paid for services. It also has a significantly less polished user interface and can at times feel a little clunky to use. Still, it's not a bad place to start.

9. Webroot Security and Antivirus: Free

Webroot Security and Antivirus is another free app that offers users online identity protection as well as defences against malware, phishing and SMS attacks.
Webroot automatically scans apps when they are added to the device. Like some of the other services on the list, Webroot can also help you to locate a lost or stolen device.
The app is perfectly adequate, with the only problem we detected that it can, at points, slow down performance on lower-end handsets.
This only really occurs when you're using the software on an old or underpowered 800MHz processor but is still an annoyance.


8. AVG Antivirus: Free or £6.50 Pro version
Available as a free download, AVG is a cheap, reliable option for any Android user.
The app automatically scans apps as they're downloaded and also checks to see if files added via other connection methods like Wi-Fi or USB are safe.
As well as checking files and apps being added to the device, the free version also lets you find your phone if lost or stolen via Google Maps. It also features lock and wipe your device services.
There is a Pro version available on the Google Play store, which costs £6.50 and adds a few features like a task killer, though for the money, given how good the free version is, we found little incentive to upgrade.
7. Norton Mobile Security: £29.99
Norton Mobile Security offers Android customers all the standard services and tools you'll require to protect your smartphone's data.
The app boasts the usual anti-virus protection backed up by remote locate, lock and wipe, call and text blocker and anti-phishing web protection features.
As an added bonus, the company's recently inked a deal with UK retailer Carphone Warehouse, meaning you can pick it up for half-price at £14.99 instead of £29.99.

6. Trend Micro Mobile Security Personal Edition: Free or £19 a year
Trend Micro's Mobile Security app is available in free and paid for versions, though the paid for option is the only one that offers a full security service.
The free app is available on Google Play and includes a basic malware scanner that scans your phone or SD-card for malicious software.
The paid for premium version is available for £19 per year. For the money you get a host of new features including parental controls, the ability to remotely locate your device and a fraudulent-website blocker that checks sites using Trend Micro's Smart Protection Network.
One annoyance that can seem a little pointless for business users is the addition of parental control features to the app. While control options may be desirable for parents looking to stop their child downloading dangerous apps, they really aren't relevant to business or adult users.
5. F-Secure Mobile Security: £8.08 per six months
F-Secure's Mobile Security app offers a number of mobile security features including firewall and anti-theft protection and costs £8.08 per half year.
The features on it work incredibly well and the app would rank higher if it didn't lack certain key features like an app scanner.
Given the boom in Android Trojans this year, the lack of an app scanning feature is a serious flaw and means you may have to get a second security app to really protect your handset.
The app also has parental control features, though as was the case with Trend Micro's app, they aren't all that useful for adult smartphone users, but nice to know they're there, just in case.

4. McAfee Mobile Security: £29.99 a year
McAfee Mobile Security application offers a desktop anti-virus and protection service on a smartphone.
The service is free for the first seven days but costs £29.99 per year after that. As well as Android, there are also BlackBerry and Symbian versions.
In terms of features Mobile Security 2.0 offers the complete package, boasting anti-virus protection, app screening, anti-theft remote wiping, unlimited backup and call filtering services.
The only reason the app didn't rank higher in our list is its liberal use of alerts. The app will pop up and intrude on your smartphone web and app browsing experience on a regular basis.
One particularly annoying feature is the fact that app actually starts alerting you on a regular basis that your free trial is about to run out a full day before it happens.
3. Bitdefender Mobile Security: Free or $9.99 a year

Bitdefender Mobile Security comes in free and premium versions, the latter retailing for a fairly reasonable $9.99 per year.
The app is a solid choice for most Android users, featuring an intuitive user interface and retailing at an affordable price.
The only downside is that the app doesn't have any SIM-card removal notification features and its Firewall protection only works on Android's native browser. That means Ice Cream Sandwich handset owners surfing the internet using the infinitely superior Chrome browser won't be protected.

2. Kaspersky Mobile Security: Free or £11.95
Kaspersky Mobile Security Lite is a fantastic Android security app that's available in free and paid for versions.

The paid for version costs £11.95 and offers the same features as a number of more expensive premium services.
The app grants access to Kaspersky's cloud-based Security Network, which automatically checks any app you install to make sure its safe.
One feature we particularly like is the educational element included in the app. Kaspersky Mobile Security doesn't take as draconian approach as other apps, with helpful hints explaining the importance of each feature being available as a shortcut on the app's user interface.
The paid for version of the app also houses all the standard device wipe, call and message filter and phone tracking services expected of any security app.
1. Lookout for Android: Free or $29.99 a year
Lookout is one of a select number of security companies purely dedicated to developing mobile security services and we have to say its Android app offers the most complete protection service currently on market.
Its Android app comes in free and paid for versions, with the paid for version costing a fairly hefty $29.99 per year.
The reason we'd really recommend the app is its intuitive user interface (UI). While the device features the same anti-virus protection, remote wipe controls, data backup, firewall defences and an app auditor services seen on other apps, Lookout is much more streamlined.
This could be because of Lookout's specific mobile focus, with the UI being far easier to navigate and understand than a number of its competitors. This streamlined feel is enhanced by the apps nonintrusive nature, with its protection features remaining nicely out of sight.

Read More

Social Engineering Fundamentals, Part I: Hacker Tactics

A True Story

One morning a few years back, a group of strangers walked into a large shipping firm and walked out with access to the firm’s entire corporate network. How did they do it? By obtaining small amounts of access, bit by bit, from a number of different employees in that firm. First, they did research about the company for two days before even attempting to set foot on the premises. For example, they learned key employees’ names by calling HR. Next, they pretended to lose their key to the front door, and a man let them in. Then they "lost" their identity badges when entering the third floor secured area, smiled, and a friendly employee opened the door for them.

The strangers knew the CFO was out of town, so they were able to enter his office and obtain financial data off his unlocked computer. They dug through the corporate trash, finding all kinds of useful documents. They asked a janitor for a garbage pail in which to place their contents and carried all of this data out of the building in their hands. The strangers had studied the CFO's voice, so they were able to phone, pretending to be the CFO, in a rush, desperately in need of his network password. From there, they used regular technical hacking tools to gain super-user access into the system.

In this case, the strangers were network consultants performing a security audit for the CFO without any other employees' knowledge. They were never given any privileged information from the CFO but were able to obtain all the access they wanted through social engineering. (This story was recounted by Kapil Raina, currently a security expert at Verisign and co-author of mCommerce Security: A Beginner's Guide, based on an actual workplace experience with a previous employer.)

Definitions

Most articles I’ve read on the topic of social engineering begin with some sort of definition like “the art and science of getting people to comply to your wishes” (Bernz 2), “an outside hacker’s use of psychological tricks on legitimate users of a computer system, in order to obtain information he needs to gain access to the system” (Palumbo), or “getting needed information (for example, a password) from a person rather than breaking into a system” (Berg). In reality, social engineering can be any and all of these things, depending upon where you sit. The one thing that everyone seems to agree upon is that social engineering is generally a hacker’s clever manipulation of the natural human tendency to trust. The hacker’s goal is to obtain information that will allow him/her to gain unauthorized access to a valued system and the information that resides on that system.

Security is all about trust. Trust in protection and authenticity. Generally agreed upon as the weakest link in the security chain, the natural human willingness to accept someone at his or her word leaves many of us vulnerable to attack. Many experienced security experts emphasize this fact. No matter how many articles are published about network holes, patches, and firewalls, we can only reduce the threat so much... and then it’s up to Maggie in accounting or her friend, Will, dialing in from a remote site, to keep the corporate network secured.

Target and Attack

The basic goals of social engineering are the same as hacking in general: to gain unauthorized access to systems or information in order to commit fraud, network intrusion, industrial espionage, identity theft, or simply to disrupt the system or network. Typical targets include telephone companies and answering services, big-name corporations and financial institutions, military and government agencies, and hospitals. The Internet boom had its share of industrial engineering attacks in start-ups as well, but attacks generally focus on larger entities.

Finding good, real-life examples of social engineering attacks is difficult. Target organizations either do not want to admit that they have been victimized (after all, to admit a fundamental security breach is not only embarrassing, it may damaging to the organization’s reputation) and/or the attack was not well documented so that nobody is really sure whether there was a social engineering attack or not.

As for why organizations are targeted through social engineering – well, it’s often an easier way to gain illicit access than are many forms of technical hacking. Even for technical people, it’s often much simpler to just pick up the phone and ask someone for his password. And most often, that’s just what a hacker will do.

Social engineering attacks take place on two levels: the physical and the psychological. First, we'll focus on the physical setting for these attacks: the workplace, the phone, your trash, and even on-line. In the workplace, the hacker can simply walk in the door, like in the movies, and pretend to be a maintenance worker or consultant who has access to the organization. Then the intruder struts through the office until he or she finds a few passwords lying around and emerges from the building with ample information to exploit the network from home later that night. Another technique to gain authentication information is to just stand there and watch an oblivious employee type in his password.

Social Engineering by Phone

The most prevalent type of social engineering attack is conducted by phone. A hacker will call up and imitate someone in a position of authority or relevance and gradually pull information out of the user. Help desks are particularly prone to this type of attack. Hackers are able to pretend they are calling from inside the corporation by playing tricks on the PBX or the company operator, so caller-ID is not always the best defense. Here’s a classic PBX trick, care of the Computer Security Institute: “’Hi, I’m your AT&T rep, I’m stuck on a pole. I need you to punch a bunch of buttons for me.’”

And here’s an even better one: “They’ll call you in the middle of the night: ‘Have you been calling Egypt for the last six hours?’ ‘No.’ And they’ll say, ‘well, we have a call that’s actually active right now, it’s on your calling card and it’s to Egypt and as a matter of fact, you’ve got about $2,000 worth of charges from somebody using your card. You’re responsible for the $2,000, you have to pay that...’ They’ll say, ‘I’m putting my job on the line by getting rid of this $2,000 charge for you. But you need to read off that AT&T card number and PIN and then I’ll get rid of the charge for you.’ People fall for it.” (Computer Security Institute).

Help desks are particularly vulnerable because they are in place specifically to help, a fact that may be exploited by people who are trying to gain illicit information. Help desk employees are trained to be friendly and give out information, so this is a gold mine for social engineering. Most help desk employees are minimally educated in the area of security and get paid peanuts, so they tend to just answer questions and go on to the next phone call. This can create a huge security hole.

The facilitator of a live Computer Security Institute demonstration, neatly illustrated the vulnerability of help desks when he “dialed up a phone company, got transferred around, and reached the help desk. ‘Who’s the supervisor on duty tonight?’ ‘Oh, it’s Betty.’ ‘Let me talk to Betty.’ [He’s transferred.] ‘Hi Betty, having a bad day?’ ‘No, why?...Your systems are down.’ She said, ‘my systems aren’t down, we’re running fine.’ He said, ‘you better sign off.’ She signed off. He said, ‘now sign on again.’ She signed on again. He said, ‘we didn’t even show a blip, we show no change.’ He said, ‘sign off again.’ She did. ‘Betty, I’m going to have to sign on as you here to figure out what’s happening with your ID. Let me have your user ID and password.’ So this senior supervisor at the Help Desk tells him her user ID and password.” Brilliant.

A variation on the phone theme is the pay phone or ATM. Hackers really do shoulder surf and obtain credit card numbers and PINs this way. (It happened to a friend of mine in a large US airport.) People always stand around phone booths at airports, so this is a place to be extra cautious.

Dumpster Diving

Dumpster diving, also known as trashing, is another popular method of social engineering. A huge amount of information can be collected through company dumpsters. The LAN Times listed the following items as potential security leaks in our trash: “company phone books, organizational charts, memos, company policy manuals, calendars of meetings, events and vacations, system manuals, printouts of sensitive data or login names and passwords, printouts of source code, disks and tapes, company letterhead and memo forms, and outdated hardware.”

These sources can provide a rich vein of information for the hacker. Phone books can give the hackers names and numbers of people to target and impersonate. Organizational charts contain information about people who are in positions of authority within the organization. Memos provide small tidbits of useful information for creating authenticity. Policy manuals show hackers how secure (or insecure) the company really is. Calendars are great – they may tell attackers which employees are out of town at a particular time. System manuals, sensitive data, and other sources of technical information may give hackers the exact keys they need to unlock the network. Finally, outdated hardware, particularly hard drives, can be restored to provide all sorts of useful information. (We’ll discuss how to dispose of all of this in the second installment in this series; suffice it to say, the shredder is a good place to start.)

On-Line Social Engineering

The Internet is fertile ground for social engineers looking to harvest passwords. The primary weakness is that many users often repeat the use of one simple password on every account: Yahoo, Travelocity, Gap.com, whatever. So once the hacker has one password, he or she can probably get into multiple accounts. One way in which hackers have been known to obtain this kind of password is through an on-line form: they can send out some sort of sweepstakes information and ask the user to put in a name (including e-mail address – that way, she might even get that person’s corporate account password as well) and password. These forms can be sent by e-mail or through US Mail. US Mail provides a better appearance that the sweepstakes might be a legitimate enterprise.

Another way hackers may obtain information on-line is by pretending to be the network administrator, sending e-mail through the network and asking for a user’s password. This type of social engineering attack doesn’t generally work, because users are generally more aware of hackers when online, but it is something of which to take note. Furthermore, pop-up windows can be installed by hackers to look like part of the network and request that the user reenter his username and password to fix some sort of problem. At this point in time, most users should know not to send passwords in clear text (if at all), but it never hurts to have an occasional reminder of this simple security measure from the System Administrator. Even better, sys admins might want to warn their users against disclosing their passwords in any fashion other than a face-to-face conversation with a staff member who is known to be authorized and trusted.

E-mail can also be used for more direct means of gaining access to a system. For instance, mail attachments sent from someone of authenticity can carry viruses, worms and Trojan horses. A good example of this was an AOL hack, documented by VIGILANTe: “In that case, the hacker called AOL’s tech support and spoke with the support person for an hour. During the conversation, the hacker mentioned that his car was for sale cheaply. The tech supporter was interested, so the hacker sent an e-mail attachment ‘with a picture of the car’. Instead of a car photo, the mail executed a backdoor exploit that opened a connection out from AOL through the firewall.”

Persuasion

The hackers themselves teach social engineering from a psychological point-of-view, emphasizing how to create the perfect psychological environment for the attack. Basic methods of persuasion include: impersonation, ingratiation, conformity, diffusion of responsibility, and plain old friendliness. Regardless of the method used, the main objective is to convince the person disclosing the information that the social engineer is in fact a person that they can trust with that sensitive information. The other important key is to never ask for too much information at a time, but to ask for a little from each person in order to maintain the appearance of a comfortable relationship.

Impersonation generally means creating some sort of character and playing out the role. The simpler the role, the better. Sometimes this could mean just calling up, saying: “Hi, I’m Joe in MIS and I need your password,” but that doesn’t always work. Other times, the hacker will study a real individual in an organization and wait until that person is out of town to impersonate him over the phone. According to Bernz, a hacker who has written extensively on the subject, they use little boxes to disguise their voices and study speech patterns and org charts. I’d say it’s the least likely type of impersonation attack because it takes the most preparation, but it does happen.

Some common roles that may be played in impersonation attacks include: a repairman, IT support, a manager, a trusted third party (for example, the President’s executive assistant who is calling to say that the President okayed her requesting certain information), or a fellow employee. In a huge company, this is not that hard to do. There is no way to know everyone - IDs can be faked. Most of these roles fall under the category of someone with authority, which leads us to ingratiation. Most employees want to impress the boss, so they will bend over backwards to provide required information to anyone in power.

Conformity is a group-based behavior, but can be used occasionally in the individual setting by convincing the user that everyone else has been giving the hacker the same information now requested, such as if the hacker is impersonating an IT manager. When hackers attack in such a way as to diffuse the responsibility of the employee giving the password away, that alleviates the stress on the employee.

When in doubt, the best way to obtain information in a social engineering attack is just to be friendly. The idea here is that the average user wants to believe the colleague on the phone and wants to help, so the hacker really only needs to be basically believable. Beyond that, most employees respond in kind, especially to women. Slight flattery or flirtation might even help soften up the target employee to co-operate further, but the smart hacker knows when to stop pulling out information, just before the employee suspects anything odd. A smile, if in person, or a simple “thank you” clenches the deal. And if that’s not enough, the new user routine often works too: “I’m confused, (batting eyelashes) can you help me?”

Reverse Social Engineering

A final, more advanced method of gaining illicit information is known as “reverse social engineering”. This is when the hacker creates a persona that appears to be in a position of authority so that employees will ask him for information, rather than the other way around. If researched, planned and executed well, reverse social engineering attacks may offer the hacker an even better chance of obtaining valuable data from the employees; however, this requires a great deal of preparation, research, and pre-hacking to pull off.

According to Methods of Hacking: Social Engineering, a paper by Rick Nelson, the three parts of reverse social engineering attacks are sabotage, advertising, and assisting. The hacker sabotages a network, causing a problem arise. That hacker then advertises that he is the appropriate contact to fix the problem, and then, when he comes to fix the network problem, he requests certain bits of information from the employees and gets what he really came for. They never know it was a hacker, because their network problem goes away and everyone is happy.

Conclusion

Of course, no social engineering article is complete without mention of Kevin Mitnick, so I’ll conclude with a quote from him from an article in Security Focus: “You could spend a fortune purchasing technology and services...and your network infrastructure could still remain vulnerable to old-fashioned manipulation.” Stay tuned for Part II: Combat Strategies, which will look at ways of combatting attacks by identifying attacks, and by using preventative technology, training, and policies.

To read Social Engineering, Part Two: Combat Strategies, click here.

References

Ameritech Consumer Information “Social Engineering Fraud,”
http://www.ameritech.com/content/0,3086,92,00.html

Anonymous “Social engineering: examples and countermeasures from the real-world,” Computer Security Institute
http://www.gocsi.com/soceng.htm

Arthurs, Wendy: “A Proactive Defence to Social Engineering,” SANS Institute, August 2, 2001.
http://www.sans.org/infosecFAQ/social/defence.htm

Berg, Al: “Al Berg Cracking a Social Engineer,” by, LAN Times Nov. 6, 1995.
http://packetstorm.decepticons.org/docs/social-engineering/soc_eng2.html

Bernz 1: “Bernz’s Social Engineering Intro Page”
http://packetstorm.decepticons.org/docs/social-engineering/socintro.html

Bernz 2: “The complete Social Engineering FAQ!”
http://packetstorm.decepticons.org/docs/social-engineering/socialen.txt

Harl “People Hacking: The Psychology of Social Engineering” Text of Harl’s Talk at Access All Areas III, March 7, 1997.
http://packetstorm.decepticons.org/docs/social-engineering/aaatalk.html

Mitnick, Kevin: “My first RSA Conference,” SecurityFocus, April 30, 2001
http://www.securityfocus.com/news/199

Orr, Chris “Social Engineering: A Backdoor to the Vault,”, SANS Institute, September 5, 2000
http://www.sans.org/infosecFAQ/social/backdoor.htm

Palumbo, John “Social Engineering: What is it, why is so little said about it and what can be done?”, SANS Institute, July 26, 2000
http://www.sans.org/infosecFAQ/social/social.htm

Stevens, George: “Enhancing Defenses Against Social Engineering” SANS Institute, March 26, 2001
http://www.sans.org/infosecFAQ/social/defense_social.htm

Tims, Rick “Social Engineering: Policies and Education a Must” SANS Institute, February 16, 2001
http://www.sans.org/infosecFAQ/social/policies.htm

Verizon “PBX Social Engineering Scam” 2000
http://www.bellatlantic.com/security/fraud/pbx_scam.htm

VIGILANTe “Social Engineering” 2001
http://www.vigilante.com/inetsecurity/socialengineering.htm

Read More

7 Ways to Improve Your Network’s Web Security

Admins looking to improve on their company’s web security often turn to software solutions to help assess and automate their security tasks. Good web security software can make surfing the web safe and secure by protecting users from potential vulnerabilities in their operating systems or browsers, as well as helping them to avoid policy violations. The top web security software packages can help you to improve your network’s web security in many ways. Here are seven of the major benefits web security software offers:

1. Automatic blocking of malicious content

Compromised websites can lead to compromised workstations. Whether it’s a malicious script or a media file, web security software can scan and block data before displaying it in a browser compromises a machine.

2. Scan downloads for malware

Users frequently go to the Internet to download files, whether those are programs, music, or screensavers. Web security software can scan those downloads with multiple anti-malware engines to ensure maximum protection for your users.

3. Support acceptable use/appropriate content policies

There’s a time and a place for most things; but many of those things are not appropriate at the workplace. Web security software can proactively block access to websites containing content that is not right for access during working hours, which helps users avoid policy violations or other situations that can impact others.

4. HTTPS inspection

Many times, HTTPS is used to get around filters and proxies because they cannot inspect encrypted traffic. With all the Certificate Authorities that have been compromised in the past few months, this could be a huge risk, but the best web security software can use PKI to scan even HTTPS traffic while still protecting the confidentiality of data.

5. Bandwidth controls prevent impact to mission critical apps

Web security software can also enforce bandwidth limits on users’ browsing, so that your ecommerce site, email system, etc., don’t suffer from slow performance due to Internet access.

6. Block phishing sites

You can read a new story every week about a company that lost data, money, and customer confidence because an employ fell victim to a phishing attack. Web security software can stop these kinds of scams dead in their tracks by blocking access to phishing sites.

7. The exception is the rule

The best web security software should use a combination of lists, categories, reputation, whitelists and blacklists to control Internet access, and easily allow admins to create exceptions when a site may be categorized one way, but is still necessary for a business purpose.

With good web security software, administrators can allow their users safe and secure access to the Internet, while protecting them, the company’s data and reputation, and their customers from the worst the web has to offer. Web security software is the right way to take advantage of the best that Internet access has to offer, while avoiding the worst threats that are out there. Web security software is one of the must-have applications every network admin needs.

This guest post was provided by Casper Manes on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. Learn more on what to include in your web security strategy.

All product and company names herein may be trademarks of their respective owners.

Read More

Tips to Keep Your Computer Virus-Free

10. Use common sense. It's always better to err on the side of safety. If you're unsure about an attachment, delete it. Especially if it's from a source you don't recognize. If there are tempting animations on a site that look highly unprofessional, don't download them.

9. Scan files for viruses before using them. This is always important, but especially if you are using a disc or flash memory to carry information between one computer and another. You could easily pick up a virus from a corrupted file and introduce it into your system. Running a virus scan before launching any of new files will prevent infection.

8. Don't share data CDs. Even a well-meaning friend may unknowingly pass along a virus, Trojan horse, or worm. Label your discs clearly so you know they're yours and don't loan them out. If a friend passes you a foreign disc, suggest an alternative method of file sharing.

7. Don't boot from an unknown data CD. Data CDs are one of the most common ways viruses are transmitted. If you are using a data CD while working on your computer, remove it when you shut the machine off or the computer may automatically try to boot from the disc, perhaps launching or installing bad programs or files on your computer.

6. Don't download programs from the Web. Unreliable sources such as Internet newsgroups or Web sites that you haven't heard of may be willing providers of viruses for your computer. Avoid downloading files you can't be sure are safe. This includes freeware, screensavers, games, and any other executable program—any files with an ".exe" or "".com" extension, such as "coolgame.exe." Check to see if the site has anti-virus software running on their side. If you do have to download from the Internet, be sure to scan each program before running it. Save all downloads to one folder, then run virus checks on everything in the folder before using it.

5. Update your anti-virus software frequently. An antivirus software program is only as good as the frequency with which it is updated. New viruses, worms, and Trojan horses are born daily, and variations of them can slip by software that is not current. Norton AntiVirus has a feature that searches for new virus definitions every time you go online, so you are always up to date.

4. Get immediate protection. Configure your antivirus software to boot automatically on start-up and run at all times. This will provide you back-up protection in case you forget to scan an attachment, or decide not to. And in case you forget to boot up your antivirus software, configuring it to start by itself will ensure you get immediate protection anyway.

3. Scan all incoming email attachments. Be sure to run each attachment you plan to open through the anti-virus check. Do this even if you recognize and trust the sender; malicious code, like Trojan horses, can slip into your system by appearing to be from a friendly source.

2. Don't automatically open attachments. Be sure your email program doesn't automatically download attachments. This will ensure that you can examine and scan attachments before they run. Refer to your email program's safety options or preferences menu for instructions.

1. Install reliable antivirus software. Antivirus software scans files regularly for unusual changes in file size, programs that match the software's database of known viruses, suspicious email attachments, and other warning signs. It's the most important step you can take towards keeping your computer clean of viruses. Norton AntiVirus is the world's leading antivirus software. It runs continuously in the background of your computer, providing constant protection from viruses, Trojan horses, worms, and other malicious code. To stay up-to-date on the latest online threats, Norton AntiVirus automatically updates its virus definitions whenever you're online.

Read More

Understanding Hidden Threats: Rootkits and Botnets

What are rootkits and botnets?

A rootkit is a piece of software that can be installed and hidden on your computer without your knowledge. It may be included in a larger software package or installed by an attacker who has been able to take advantage of a vulnerability on your computer or has convinced you to download it (see Avoiding Social Engineering and Phishing Attacks for more information). Rootkits are not necessarily malicious, but they may hide malicious activities. Attackers may be able to access information, monitor your actions, modify programs, or perform other functions on your computer without being detected.
Botnet is a term derived from the idea of bot networks. In its most basic form, a bot is simply an automated computer program, or robot. In the context of botnets, bots refer to computers that are able to be controlled by one, or many, outside sources. An attacker usually gains control by infecting the computers with a virus or other malicious code that gives the attacker access. Your computer may be part of a botnet even though it appears to be operating normally. Botnets are often used to conduct a range of activities, from distributing spam and viruses to conducting denial-of-service attacks (seeUnderstanding Denial-of-Service Attacks for more information).

Why are they considered threats?

The main problem with both rootkits and botnets is that they are hidden. Although botnets are not hidden the same way rootkits are, they may be undetected unless you are specifically looking for certain activity. If a rootkit has been installed, you may not be aware that your computer has been compromised, and traditional anti-virus software may not be able to detect the malicious programs. Attackers are also creating more sophisticated programs that update themselves so that they are even harder to detect.
Attackers can use rootkits and botnets to access and modify personal information, attack other computers, and commit other crimes, all while remaining undetected. By using multiple computers, attackers increase the range and impact of their crimes. Because each computer in a botnet can be programmed to execute the same command, an attacker can have each of them scanning multiple computers for vulnerabilities, monitoring online activity, or collecting the information entered in online forms.

What can you do to protect yourself?

If you practice good security habits, you may reduce the risk that your computer will be compromised:

• Use and maintain anti-virus software - Anti-virus software recognizes and protects your computer against most known viruses, so you may be able to detect and remove the virus before it can do any damage (see Understanding Anti-Virus Software for more information). Because attackers are continually writing new viruses, it is important to keep your definitions up to date. Some anti-virus vendors also offer anti-rootkit software.


• Install a firewall - Firewalls may be able to prevent some types of infection by blocking malicious traffic before it can enter your computer and limiting the traffic you send (see Understanding Firewalls for more information). Some operating systems actually include a firewall, but you need to make sure it is enabled.


• Use good passwords - Select passwords that will be difficult for attackers to guess, and use different passwords for different programs and devices (see Choosing and Protecting Passwords for more information). Do not choose options that allow your computer to remember your passwords.


• Keep software up to date - Install software patches so that attackers can't take advantage of known problems or vulnerabilities (see Understanding Patches for more information). Many operating systems offer automatic updates. If this option is available, you should enable it.


• Follow good security practices - Take appropriate precautions when using email and web browsers to reduce the risk that your actions will trigger an infection (see other US-CERT security tips for more information).

Unfortunately, if there is a rootkit on your computer or an attacker is using your computer in a botnet, you may not know it. Even if you do discover that you are a victim, it is difficult for the average user to effectively recover. The attacker may have modified files on your computer, so simply removing the malicious files may not solve the problem, and you may not be able to safely trust a prior version of a file. If you believe that you are a victim, consider contacting a trained system administrator.
As an alternative, some vendors are developing products and tools that may remove a rootkit from your computer. If the software cannot locate and remove the infection, you may need to reinstall your operating system, usually with a system restore disk that is often supplied with a new computer. Note that reinstalling or restoring the operating system typically erases all of your files and any additional software that you have installed on your computer. Also, the infection may be located at such a deep level that it cannot be removed by simply reinstalling or restoring the operating system.

Read More

Understanding Hidden Threats: Corrupted Software Files

National Cyber Alert System - Understanding Hidden Threats: Corrupted Software Files

 Malicious code is not always hidden in web page scripts or unusual file formats. Attackers may corrupt types of files that you would recognize and typically consider safe, so you should take precautions when opening files from other people.

What types of files can attackers corrupt?

An attacker may be able to insert malicious code into any file, including common file types that you would normally consider safe. These files may include documents created with word processing software, spreadsheets, or image files. After corrupting the file, an attacker may distribute it through email or post it to a website. Depending on the type of malicious code, you may infect your computer by just opening the file.
When corrupting files, attackers often take advantage of vulnerabilities that they discover in the software that is used to create or open the file. These vulnerabilities may allow attackers to insert and execute malicious scripts or code, and they are not always detected. Sometimes the vulnerability involves a combination of certain files (such as a particular piece of software running on a particular operating system) or only affects certain versions of a software program.

What problems can malicious files cause?

There are various types of malicious code, including viruses, worms, and Trojan horses (see Why is Cyber Security a Problem? for more information). However, the range of consequences varies even within these categories. The malicious code may be designed to perform one or more functions, including

• interfering with your computer's ability to process information by consuming memory or bandwidth (causing your computer to become significantly slower or even "freeze")
• installing, altering, or deleting files on your computer
• giving the attacker access to your computer
• using your computer to attack other computers (see Understanding Denial-of-Service Attacks for more information)

How can you protect yourself?

• Use and maintain anti-virus software - Anti-virus software can often recognize and protect your computer against most known viruses, so you may be able to detect and remove the virus before it can do any damage (seeUnderstanding Anti-Virus Software for more information). Because attackers are continually writing new viruses, it is important to keep your definitions up to date.


• Use caution with email attachments - Do not open email attachments that you were not expecting, especially if they are from people you do not know. If you decide to open an email attachment, scan it for viruses first (see Using Caution with Email Attachments for more information). Not only is it possible for attackers to "spoof" the source of an email message, but your legitimate contacts may unknowingly send you an infected file. If your email program automatically downloads and opens attachments, check your settings to see if you can disable this feature.


• Be wary of downloadable files on websites - Avoid downloading files from sites that you do not trust. If you are getting the files from a supposedly secure site, look for a website certificate (see Understanding Web Site Certificates for more information). If you do download a file from a website, consider saving it to your computer and manually scanning it for viruses before opening it.


• Keep software up to date - Install software patches so that attackers cannot take advantage of known problems or vulnerabilities (see Understanding Patches for more information). Many operating systems offer automatic updates. If this option is available, you should enable it.


• Take advantage of security settings - Check the security settings of your email client and your web browser (seeEvaluating Your Web Browser's Security Settings for more information). Apply the highest level of security available that still gives you the functionality you need.

Read More

Preventing and Responding to Identity Theft

Is identity theft just a problem for people who submit information online?

You can be a victim of identity theft even if you never use a computer. Malicious people may be able to obtain personal information (such as credit card numbers, phone numbers, account numbers, and addresses) by stealing your wallet, overhearing a phone conversation, rummaging through your trash (a practice known as dumpster diving), or picking up a receipt at a restaurant that has your account number on it. If a thief has enough information, he or she may be able to impersonate you to purchase items, open new accounts, or apply for loans.
The internet has made it easier for thieves to obtain personal and financial data. Most companies and other institutions store information about their clients in databases; if a thief can access that database, he or she can obtain information about many people at once rather than focus on one person at a time. The internet has also made it easier for thieves to sell or trade the information, making it more difficult for law enforcement to identify and apprehend the criminals.

How are victims of online identity theft chosen?

Identity theft is usually a crime of opportunity, so you may be victimized simply because your information is available. Thieves may target customers of certain companies for a variety of reasons; for example, a company database is easily accessible, the demographics of the customers are appealing, or there is a market for specific information. If your information is stored in a database that is compromised, you may become a victim of identity theft.

Are there ways to avoid being a victim?

Unfortunately, there is no way to guarantee that you will not be a victim of online identity theft. However, there are ways to minimize your risk:

• Do business with reputable companies - Before providing any personal or financial information, make sure that you are interacting with a reputable, established company. Some attackers may try to trick you by creating malicious web sites that appear to be legitimate, so you should verify the legitimacy before supplying any information (see Avoiding Social Engineering and Phishing Attacks and Understanding Web Site Certificates for more information).


• Take advantage of security features - Passwords and other security features add layers of protection if used appropriately (see Choosing and Protecting Passwords and Supplementing Passwords for more information).


• Check privacy policies - Take precautions when providing information, and make sure to check published privacy policies to see how a company will use or distribute your information (see Protecting Your Privacy and How Anonymous Are You? for more information). Many companies allow customers to request that their information not be shared with other companies; you should be able to locate the details in your account literature or by contacting the company directly.


• Be careful what information you publicize - Attackers may be able to piece together information from a variety of sources. Avoid posting personal data in public forums (see Guidelines for Publishing Information Online for more information).


• Use and maintain anti-virus software and a firewall - Protect yourself against viruses and Trojan horses that may steal or modify the data on your own computer and leave you vulnerable by using anti-virus software and a firewall (see Understanding Anti-Virus Software and Understanding Firewalls for more information). Make sure to keep your virus definitions up to date.


• Be aware of your account activity - Pay attention to your statements, and check your credit report yearly. You are entitled to a free copy of your credit report from each of the main credit reporting companies once every twelve months (see AnnualCreditReport.com for more information).

How do you know if your identity has been stolen?

Companies have different policies for notifying customers when they discover that someone has accessed a customer database. However, you should be aware of changes in your normal account activity. The following are examples of changes that could indicate that someone has accessed your information:

• unusual or unexplainable charges on your bills
• phone calls or bills for accounts, products, or services that you do not have
• failure to receive regular bills or mail
• new, strange accounts appearing on your credit report
• unexpected denial of your credit card

What can you do if you think, or know, that your identity has been stolen?

Recovering from identity theft can be a long, stressful, and potentially costly process. Many credit card companies have adopted policies that try to minimize the amount of money you are liable for, but the implications can extend beyond your existing accounts. To minimize the extent of the damage, take action as soon as possible:

• Contact companies, including banks, where you have accounts - Inform the companies where you have accounts that someone may be using your identity, and find out if there have been any unauthorized transactions. Close accounts so that future charges are denied. In addition to calling the company, send a letter so there is a record of the problem.


• Contact the main credit reporting companies (Equifax, Experian, TransUnion) - Check your credit report to see if there has been unexpected or unauthorized activity. Have a fraud alerts placed on your credit reports to prevent new accounts being opened without verification.


• File a report - File a report with the local police so there is an official record of the incident. You can also file a complaint with the Federal Trade Commission.


• Consider other information that may be at risk - Depending what information was stolen, you may need to contact other agencies; for example, if a thief has access to your Social Security number, contact the Social Security Administration. You should also contact the Department of Motor Vehicles if your driver's license or car registration have been stolen.

The following sites offer additional information and guidance for recovering from identity theft:

• Federal Trade Commission - http://www.ftc.gov/bcp/edu/microsites/idtheft/
• United States Department of Justice - http://www.usdoj.gov/criminal/fraud/websites/idtheft.html
• Social Security Administration - http://www.ssa.gov/pubs/idtheft.htm

Read More