How to check for SQL injection vulnerabilities

Securing your website and web applications from SQL Injection involves a three-part process:

1. Analysing the present state of security present by performing a thorough audit of your website and web applications for SQL Injection and other hacking vulnerabilities.
2. Making sure that you use coding best practice santising your web applications and all other components of your IT infrastructure.
3. Regularly performing a web security audit after each change and addition to your web components.

Furthermore, the principles you need to keep in mind when checking for SQL Injection and all other hacking techniques are the following: “Which parts of a website we thought are secure are open to hack attacks?” and “what data can we throw at an application to cause it to perform something it shouldn’t do?”.
Checking for SQL Injection vulnerabilities involves auditing your website and web applications. Manual vulnerability auditing is complex and very time-consuming. It also demands a high-level of expertise and the ability to keep track of considerable volumes of code and of all the latest tricks of the hacker’s ‘trade’.
The best way to check whether your web site and applications are vulnerable to SQL injection attacks is by using an automated and heuristic web vulnerability scanner.
An automated web vulnerability scanner crawls your entire website and should automatically check for vulnerabilities to SQL Injection attacks. It will indicate which URLs/scripts are vulnerable to SQL injection so that you can immediately fix the code. Besides SQL injection vulnerabilities a web application scanner will also check for Cross site scripting and other web vulnerabilities.
Signature-Matching versus Heuristic Scanning for SQL InjectionWhereas many organisations understand the need for automating and regularising web auditing, few appreciate the necessity of scanning both off-the-shelf AND bespoke web applications. The general misconception is these custom web applications are not vulnerable to hacking attacks. This arises more out of the “it can never happen to me” phenomenon and the confidence website owners place in their developers.
A search on Google News returned 240 matches on the keyword “SQL Injection” (at time of writing). Secunia and SecuObs report dozens of vulnerabilities of known web applications on a daily basis. Yet, examples of hacked custom applications are rarely cited in the media. This is because it is only the known organisations (e.g. Choicepoint, AT&T, PayPal) that hit the headlines over the past few months.
It is critical to understand that custom web applications are probably the most vulnerable and definitely attract the greatest number of hackers simply because they know that such applications do not pass through the rigorous testing and quality assurance processes of off-the-shelf ones.
This means that scanning a custom web application with only a signature-based scanner will not pinpoint vulnerabilities to SQL Injection and any other hacking techniques.
Establishing and testing against a database of signatures of vulnerabilities for known applications is not enough. This is passive auditing because it will only cover off-the-shelf applications and any vulnerabilities to new hacking techniques will not be discovered. In addition, signature matching would do little when a hacker launches an SQL Injection attack on your custom web applications. Hack attacks are not based on signature file testing – hackers understand that known applications, systems and servers are being updated and secured constantly and consistently by respective vendors. It is custom applications that are the proverbial honey pot.
It is only a handful of products that deploy rigorous and heuristic technologies to identify the real threats. True automated web vulnerability scanning almost entirely depends on (a) how well your site is crawled to establish its structure and various components and links, and (b) on the ability of the scanner to leverage intelligently the various hacking methods and techniques against your web applications.
It would be useless to detect the known vulnerabilities of known applications alone. A significant degree of heuristics is involved in detecting vulnerabilities since hackers are extremely creative and launch their attacks against bespoke web applications to create maximum impact.

download the scanner today!

What Is a Computer 'Protocol'? How Do Protocols Affect My Web Surfing?

You see 'http://' and 'ftp://' in Web page addresses. What are these 'protocols'? How do they affect me?

A 'protocol' is a set of invisible computer rules that govern how an Internet document gets transmitted to your screen. These dozens of programmatic rules work in the background in the same way a bank employs staff procedures to keep your money safe.

A document's Internet protocol is described by the the first several letters in your browser's address bar, ending in the three characters '://'. The most common protocol you will see is http:// for a regular hypertext page. The second most common protocol you will see is https://, for hypertext pages that are secured against hackers. Examples of Internet computer protocols:

• http Hypertext Transfer Protocol
• https Hypertext Transfer Protocol Secured
• TCP/IP Transmission Control Protocol/Internet Protocol
• ftp File Transfer Protocol
• IMAP Internet Message Access Protocol
• POP Post Office Protocol
• SMTP Simple Mail Transfer Protocol
• telnet Terminal Network protocol
• UDP User Datagram Protocol
• nntp Network News Transfer Protocol
• MAC Media Access Control protocol
• DNS Domain Name System protocol
• DHCP Dynamic Host Configuration Protocol

How Do Computer Protocols Affect My Web Surfing?

While computer protocols can be very cryptic and technical for programmers and administrators, protocols are really just FYI knowledge for most users. As long as you are aware of the 'http' and 'https' at the beginning of the address, and can type the correct address after the ://, then computer protocols should be nothing more than a curiousity of daily life.

http://hackerzadda.blogspot.com/2011/03/protocol-network.html

Protocol (Network)

Definition: A network protocol defines rules and conventions for communication between network devices. Protocols for computer networking all generally use packet switching techniques to send and receive messages in the form of packets


Network protocols include mechanisms for devices to identify and make connections with each other, as well as formatting rules that specify how data is packaged into messages sent and received. Some protocols also support message acknowledgement and data compression designed for reliable and/or high-performance network communication. Hundreds of different computer network protocols have been developed each designed for specific purposes and environments.

Internet Protocols

The Internet Protocol family contains a set of related (and among the most widely used network protocols. Besides Internet Protocol (IP) itself, higher-level protocols like TCP, UDP, HTTP, and FTP all integrate with IP to provide additional capabilities. Similarly, lower-level Internet Protocols like ARP and ICMP also co-exist with IP. These higher level protocols interact more closely with applications like Web browsers while lower-level protocols interact with network adapters and other computer hardware.

Routing Protocols

Routing protocols are special-purpose protocols designed specifically for use by network routers on the Internet. Common routing protocols include EIGRP, OSPF and BGP.

How Network Protocols Are Implemented

Modern operating systems like Microsoft Windows contain built-in services or daemons that implement support for some network protocols. Applications like Web browsers contain software libraries that support the high level protocols necessary for that application to function. For some lower level TCP/IP and routing protocols, support is implemented in directly hardware (silicon chipsets) for improved performance.

How to Tell a Facebook Friend From a Facebook Hacker

Did your grandmother just post a Facebook link to "Hot Shocking Sexy Pics of Britney Spears"? Maybe that's how your grandma rolls, but chances are it's probably the hacker who just "pwned" her Facebook account. Here are some tips to help you tell the difference between Facebook friend or foe.

1. Is the post out of character for the person posting it?
I'm going to go out on a limb and say that grandmothers typically have no desire to send porn links to their closest friends and family members. This post is obviously way out of character for her, making it highly likely that someone else is using her account. The link that was sent from her account will likely send you to a phishing site or prompt you to install a rogue Facebook application that might pillage your personal information.

2. Is the the language used in the post normal for the region?
My grandmother was many things, but a bad speller with a poor command of the English language wasn't one of them. Given the global reach of the Internet, a Facebook account can be hacked from anywhere in the world. Hackers will try to impersonate the user of the hacked account as best they can. The problem is that if the hacker isn't a native of the country of their victim, then they might be unable to accurately imitate the colloquial expressions or local slang used in the country of their victim's hacked account.
Let's imagine an example:

Actual post from grandma: "Good luck with your tests next week honey. I'm sure they will be a piece of cake."

Hacker trying to impersonate grandma from her hacked account: "May luck be with you for your examinations. It will be a piece of pizza."
This should be a dead giveaway that grandma's account was hacked or at least that someone needs to check and make sure she's taking all her proper medications.
3. Does the post ask for money or phish for personal information?

There is a popular scam on Facebook where a hacker using a compromised account impersonates someone and posts that they need money because they are lost in a foreign country or stuck somewhere without their passport, wallet, etc. Eager to help a friend in need, their Facebook friend wires them money only to find out later that they were duped by a hacker.
What if your friend is really lost and in need? You would hate to leave them stranded, right? Call your friend or check with their family to see if the story holds true. If you can't verify the story by phone or other means, ask your friend (or the hacker) questions that only your friend should know the answers to (and not stuff that they could find on your Facebook profile page).
4. Does the link in the post look strange or use a link shortening service like Bit.ly?

People love using link shortening services because they can take a huge web address and shorten it to just a few characters, making it easier to remember and short enough to fit into a Twitter post. The problem is that link shortening services like Bit.ly are often used by hackers to mask the true destination web addresses of phishing sites or other harmful web-based malware.
To verify the true destination of a shortened link you should check the link with a link lengthening site like Untiny. The lengthening site will show you the destination redirect link without having to visit it yourself. This lets you check to see if it's safe before going there.

5. Was the post placed on the walls of all of the poster's Facebook friends?
If you see an odd post on your wall, check to see if it's also on the walls of some of your mutual friends.
Many hackers and rogue Facebook apps will attempt to spread their links like a virus by abusing the "Allow Friends to Post on My Wall" Facebook permission that many of us have enabled. The hacker and/or rogue app will usually post the same scam or phishing link to the wall of every friend on the victim's friends list. This allows them to rapidly spread the link or app to as many people as possible. Additionally, the posts are spread even further because wall posts show up in the live feed and many people will share something without even visiting it first.

Disaster Recovery Planning Keys to Success

Disaster recovery planning is a great idea until someone actually has to do it. There are many reasons and events that will try and sabotage your disaster recovery planning project. Here are 10 keys to developing a successful disaster recovery plan and implementing it successfully.

1. Set Expectations for The Disaster Recovery Plan

Everyone will agree that your company needs a disaster recovery plan. Each person will also have a different preconceived notion of what the disaster recovery plan will cover. The first critical success factor is to define the disaster recovery plan in terms of what the plan will cover and, most importantly, what the disaster recovery plan will not cover. Make sure that the key stakeholders have input into the development of the project definition.

 

2. Create a Detailed Project Plan and Budget

Identify the resources and activities that will be required to complete the disaster recovery plan. This may include employees' time and the purchase of physical resources such as software and equipment. Aggregate this into a realistic time-line that will set the delivery date for the disaster recovery plan. Create a realistic budget so upper management will not be surprised and finance can plan appropriately. Make sure to include Key Performance Indicators (KPI) that measure the success of each step in the project.

3. Get Upper Management Support

For a project to succeed that crosses all organizational boundaries, you must start at the top. After agreement has been reached on the project time-line and budget, executive support and commitment must be obtained. Without this, the project will always be on the back-burner and will never reach completion. Make sure upper management is aware of the disaster recovery planning goals and objectives.

4. Select the Best to Obtain the Best

The most detailed project plan that is accompanied with a realistic budget and has the "blessing" of upper management can still fail. To increase the likelihood of success, select the best people from each department that will be impacted by the disaster recovery plan. In addition to greatly contributing to the plan, these people will also be the project champions that will make sure the disaster recovery planning project does not get shifted to the back-burner.

5. Admit That You Didn't Think of Everything

As the disaster recovery planning project progresses, you will become more knowledgeable with the inner workings of your company. In fact you may actually have to modify the project plan when you discover something that was not in the plan. Be up front with all those involved and promptly notify upper management if the change is significant.

6. Avoid Scope Creep

Although you admit that you didn't think of everything, you don't have to add everything you discover to the project. Evaluate each new discovery in terms of the project definition that was created in Step #1 (see above "Set Expectations for The Disaster Recovery Plan"). If the item is outside the scope of the project definition, differ action on it until the disaster recovery plan is complete.

7. Manage the Plan

Take time throughout the project to evaluate your progress. Look at what has been accomplished, what remains to be done and what obstacles you have overcome. Make adjustment where necessary to keep the project on track. Also, assess the quality of the work that is being done. Redo any items that are not up to the highest quality standards.

8. Report Early and Often

Don't wait until there is a problem or the disaster recovery plan is almost complete to make a progress report to the stakeholders and upper management. Take advantage of the reporting mechanisms that are already established in your company. Get a standing agenda item on the "weekly production meeting" or the "monthly managers meeting." At least create an email distribution list that you can use to send a weekly updates.

 

9. Change Isn't Easy

It is human nature to resist change. You will be asking employees to spend time on a project that they are not interested in. Procedures and job functions may have to be altered in order to accommodate the new disaster recovery plan. Seek first to understand what the change will mean to the employees affected. Listen, learn and take notes. Make any adjustments from what you have learned and then explain the "what" and the "why" of the changes that need to be implemented.

10. Report the Final Results

The disaster recovery planning project isn't over until the final report is given to the stakeholders and upper management. Report on the success of each step in the project as indicated by the measurement of Key Performance Indicators that were originally defined. Present your budget versus actual spending report and explain why you went over or under budget. This will bring the project to closure and bring recognition to those who participated.

 

Have a Disaster Recovery Plan (DRP)?

Whether you're a home PC user or a network administrator, you always need a plan for when the unexpected happens to your computers and/or network. A Disaster Recovery Plan (DRP) is essential in helping to ensure that you don't get fired after a server gets fried in a fire, or in the case of the home user, that you don't get kicked out of the house when momma discovers you've just lost years worth of irreplaceable digital baby photos.
A DRP doesn't have to be overly complicated. You just need to cover the basic things that it will take to get back up and running again if something bad happens. Here are some items that should be in every good disaster recovery plan:
1. Backups, Backups, Backups!
Most of us think about backups right after we've lost everything in a fire, flood, or burglary. We think to ourselves, "I sure hope I have a backup of my files somewhere". Unfortunately, wishing and hoping won't bring back dead files or keep your wife from flogging you about the head and neck after you've lost gigabytes of family photos. You need to have a plan for regularly backing up your critical files so that when a disaster occurs you can recover what was lost.
There are dozens of online backup services available that will backup your files to an off-site location via a secure connection. If you don't trust "The Cloud" you can elect to keep things in-house by purchasing an external backup storage device such as a Drobo.
Whichever method you choose, make sure you set a schedule to backup all your files at least once weekly, with incremental backups each night if possible. Additionally, you should periodically make a copy of your backup and store it off-site in a fire safe, safe deposit box, or somewhere other than where your computers reside. Off-site backups are important because your backup is useless if it's burned up in the same fire that just torched your computer.
2. Document Critical Information

If you encounter a major disaster, you're going to loose a lot of information that may not be inside of a file. This information will be critical to getting back to normal and includes items such as:

• Make, model, and warranty information for all your computers and other peripherals
• Account names and passwords (for e-mail, ISP, wireless routers, wireless networks, admin accounts, System BIOS)
• Network settings (IP addresses of all PCs, firewall rules, domain info, server names)
• Software license information (list of installed software, license keys for re-installation, version info)
• Support phone numbers (for ISP, PC manufacturer, network administrators, tech support)

3. Plan for Extended Downtime
If you're a network administrator you'll need to have a plan that covers what you will do if the downtime from the disaster is expected to last more than a few days. You'll need to identify possible alternate sites to house your servers if your facilities are going to be unusable for an extended period of time. Check with your management prior to looking into alternatives to get their buy-in. Ask them questions such as:

• How much downtime is tolerable to them based on their business needs?
• What is the restoration priority (which systems do they want back online first)?
• What is their budget for disaster recovery operations and preparation?

4. Plan for Getting Back to Normal
You'll need transition plan for moving your files off of the loaner you borrowed and onto the new PC you bought with your insurance check, or for moving from your alternate site back to your original server room after its been restored to normal.
Test and update your DRP regularly. Make sure you keep your DRP up-to-date with all the latest information (updated points of contact, software version information, etc). Check your backup media to make sure it is actually backing something up and not just sitting idle. Check the logs to make sure the backups are running on the schedule you setup.
Again, your disaster recovery plan shouldn't be overly complicated. You want to make it useful and something that is always within arms reach. Keep a copy of it off-site as well. Now if I were you, I would go start backing up those baby pics ASAP!

About Hacking

What is Hacking?

Computer hacking is the practice of modifying computer hardware and software to accomplish a goal outside of the creator’s original purpose. Hacking is the art of exploiting the flaws/loopholes in a software/module. Since the word “hack” has long been used to describe someone who is incompetent at his/her profession, some hackers claim this term is offensive and fails to give appropriate recognition to their skills.

Who is a Hacker?

A Hacker or White Hat Hacker, also known as Ethical Hacker, is a Computer Security expert, who specialise in penetration testing, and other testing methodologies, to ensure that a company’s information systems are secure. Such people are employed by companies where these professionals are sometimes called Sneaker.

Who is a Cracker?

Black Hat Hackers, who may also be known as Crackers, are Hackers, who specialise in unauthorized penetration of information systems. They may use computers to attack systems for profit, for fun, or for political motivations, as part of a social cause. Such penetration often involves modification and/or destruction of data, and is done without authorization. They also may distribute computer viruses, Internet Worms, and deliver spam through the use of bot nets.

Who is a Script Kiddy?

A script kiddy is a wannabe cracker. These individuals lack knowledge of how a computer really works but they use well-known easy-to-find techniques and programs or scripts to break into a computer to steal porn, music files, SPAM, etc.

What skills do I need to become a Hacker?

There is no magic to Hacking, but like anything else that is worthwhile it takes dedication, a willingness to learn. It is most important to have a good knowledge of topics such as Operating system and it’s working, Computer networks, Computer security and of course Programming. It’s not possible to become a hacker overnight. It’s the skill developed over a long time.

What is the best way to learn Hacking?

The best way to learn Hacking is to start learning about the basics of hacking right from now. There are many books about Hacking that are available today. But before you start learning about the details you must have a basic skills of Programming and knowledge of Computer network security. Internet is the best source to learn about hacking.

How do I secure my computer from being Hacked?

Having a basic knowledge of computer security and related topics such as Virus, Trojans, spyware, phishing etc. is more than enough to secure your computer. Install a good antivirus and a firewall.

Five Tips for Online Shopping Safety

One of the coolest capabilities enabled by the Internet is that when you’re using it, you’re not bound by geographical location. This is especially handy when you’re shopping. Before the Internet, you were pretty much stuck with the selection and prices in the stores around your home. Now, you can shop anywhere, anytime, and you can be competitive about it.
Of course, there are some risks that come with shopping online, too. Although identity theft is more common in the real world, it still happens online pretty frequently, as does credit card fraud. So staying safe while you’re shopping online is paramount. Here are five tips for shopping safely online:

• Choose Credit Over Debit: You probably don’t often hear advice to use a credit card instead of a debit card or cash, but if you can do it responsibly, you absolutely should. Credit cards offer protection from identity theft that debit cards don’t. For example, with a credit card, your liability for fraudulent charges caps at $50 as long as you report the fraud within 30 or 60 days (depending on the company). However, if you’re using your debit card online and someone gains access to it, they can clean out your checking account before you even learn there’s a problem. It’s likely you’ll get part of that money back, but possible that it can take a while, and that you won’t get it all. So, use a credit card instead and pay the bill off monthly.
• Disposable Is Better: Even better than using a credit card is to use a disposable credit card. Disposable credit cards work just like most gift cards. You add a specified dollar amount to the card, and it’s good until that is gone. Once it’s gone, you can add more, or purchase a new one. And both Visa and American Express now offer these cards in varying amounts, so they’re easy to get hold of. The bonus is that if the number from a disposable credit card is stolen, it’s anonymous, and criminals can’t gain access to anything more than the dollar amount that’s still available on the card.
• Verify Website Security: The variety that’s available when shopping online can be dizzying, but it doesn’t stop at just the products and prices that are available online. There are also different levels of security that are available online, and you want to be aware of them. Some online web sites don’t offer secure shopping. That means that savvy criminals can capture everything that you enter onto a form on those sites, including your personal and credit information. If you’re going to shop online, limit yourself to secure sites. You can tell if a site is secure by the URL. A secure web site starts with HTTPS:// instead of HTTP://. Secure sites will also have a small lock icon in the lower right corner of the screen.
• Don’t Shop Publically: If you plan to do any shopping online, do it at home. At home, you can shop in your pajamas (or nekkid) and you can do it any time of the day or night. You also know who accesses your computer at home. If you’re using a public computer—at the library, at a cyber café, or at work—to do your shopping, you have no control over who might be using that computer as well. You also don’t have any control over what kind of spyware or malware might be infecting that computer. So, just don’t do it. Shop at home. It’s much safer.
• Don’t Store Information Elsewhere: Many shopping sites, even the major ones, offer you the ability to save your credit card information on their servers to speed the shopping process. Think Amazon.com’s OneClick shopping. It’s definitely faster, but there are some risks to maintaining your personal information elsewhere. If a company that you’re shopping with has a data breach, your personal information could be put at risk. It takes a little longer, but instead of storing your information on some server that you have no control over, just enter it yourself each time you shop.

Price and selection are two of the best benefits to shopping online. But don’t let the benefits lull you into complacency. Take the time to shop securely, and use caution with the sites that you choose to shop on. Then, not only can you find great deals, but you can do it without the worry that your identity will be stolen in the process.

Do You Have a Disaster Recovery Plan (DRP)?

Whether you're a home PC user or a network administrator, you always need a plan for when the unexpected happens to your computers and/or network. A Disaster Recovery Plan (DRP) is essential in helping to ensure that you don't get fired after a server gets fried in a fire, or in the case of the home user, that you don't get kicked out of the house when momma discovers you've just lost years worth of irreplaceable digital baby photos.
A DRP doesn't have to be overly complicated. You just need to cover the basic things that it will take to get back up and running again if something bad happens. Here are some items that should be in every good disaster recovery plan:
1. Backups, Backups, Backups!
Most of us think about backups right after we've lost everything in a fire, flood, or burglary. We think to ourselves, "I sure hope I have a backup of my files somewhere". Unfortunately, wishing and hoping won't bring back dead files or keep your wife from flogging you about the head and neck after you've lost gigabytes of family photos. You need to have a plan for regularly backing up your critical files so that when a disaster occurs you can recover what was lost.
There are dozens of online backup services available that will backup your files to an off-site location via a secure connection. If you don't trust "The Cloud" you can elect to keep things in-house by purchasing an external backup storage device such as a Drobo.
Whichever method you choose, make sure you set a schedule to backup all your files at least once weekly, with incremental backups each night if possible. Additionally, you should periodically make a copy of your backup and store it off-site in a fire safe, safe deposit box, or somewhere other than where your computers reside. Off-site backups are important because your backup is useless if it's burned up in the same fire that just torched your computer.
2. Document Critical Information

If you encounter a major disaster, you're going to loose a lot of information that may not be inside of a file. This information will be critical to getting back to normal and includes items such as:

• Make, model, and warranty information for all your computers and other peripherals
• Account names and passwords (for e-mail, ISP, wireless routers, wireless networks, admin accounts, System BIOS)
• Network settings (IP addresses of all PCs, firewall rules, domain info, server names)
• Software license information (list of installed software, license keys for re-installation, version info)
• Support phone numbers (for ISP, PC manufacturer, network administrators, tech support)

3. Plan for Extended Downtime
If you're a network administrator you'll need to have a plan that covers what you will do if the downtime from the disaster is expected to last more than a few days. You'll need to identify possible alternate sites to house your servers if your facilities are going to be unusable for an extended period of time. Check with your management prior to looking into alternatives to get their buy-in. Ask them questions such as:

• How much downtime is tolerable to them based on their business needs?
• What is the restoration priority (which systems do they want back online first)?
• What is their budget for disaster recovery operations and preparation?

4. Plan for Getting Back to Normal
You'll need transition plan for moving your files off of the loaner you borrowed and onto the new PC you bought with your insurance check, or for moving from your alternate site back to your original server room after its been restored to normal.
Test and update your DRP regularly. Make sure you keep your DRP up-to-date with all the latest information (updated points of contact, software version information, etc). Check your backup media to make sure it is actually backing something up and not just sitting idle. Check the logs to make sure the backups are running on the schedule you setup.
Again, your disaster recovery plan shouldn't be overly complicated. You want to make it useful and something that is always within arms reach. Keep a copy of it off-site as well. Now if I were you, I would go start backing up those baby pics ASAP!

10 Tips for Shopping Safely Online

Whether you’re shopping the holiday sales, or just looking to avoid the craziness at the mall, shopping safely online can be a challenge, especially if you stray from the larger e-tailers to get a better deal from a lesser known site. Here are 10 tips to help you gain some peace of mind while shopping online.

1. Check the seller’s customer satisfaction ratings.

Other people’s experiences with the merchant that you are considering are often an excellent gauge of what to expect when you order. Review other user’s comments and check out the seller’s rating on sites like Google Shopping. Low “star” ratings may provide a red flag that cautions you to find a more reputable seller.

2. Check the Better Business Bureau site to see if there are a large number of complaints about the seller.

The Better Business Bureaus of the United States and Canada are excellent resources to find out specific information about merchants, including whether or not they have any complaints against them related to delivery, product issues, or refund or exchange problems. You can also obtain their business addresses and corporate contact information, which might allow you to circumvent the frontline call center circus of endless automated prompts (i.e. “Press 1 to speak to a semi-live person”).

3. Whenever possible, use a credit card for payment.

According to the American Bar Association’s website, safeshopping.org, it is best to use a credit card when paying online because federal law protects credit card users from fraud and limits individual liability to $50. Some card issuers might even waive the $50 liability fee or pay it for you.

Consider opening a separate account for buying online so your online purchases don’t get lost in the sea of Starbuck’s coffee transactions in your online banking ledger. Also, look into virtual credit cards if your card issuer offers this service. Some card issuers will give you a one-time use virtual card number that you can use for a single transaction if you are concerned about the security of a particular merchant.

4. Never enter your credit card information on a page that is not encrypted.

When using the online checkout process of a seller, always make sure that the web address has “https” instead of “http.” Https ensures that you are using an encrypted communications path to transmit your credit card information to the seller. This helps to ensure against eavesdropping on your transaction.

5. Go directly to the seller’s site rather than clicking a “coupon” link that was sent to you by an unknown source.

Scammers can often use a tactic called cross-site scripting to craft a hyperlink that appears to be the actual merchant site but actually relays your credit card information to the scammer when you put your payment information into the payment web form. Unless you can verify that a coupon came from the actual vendor’s site to which you have already subscribed, it’s best to avoid random coupons with unknown origins.

6. If you are ordering from a shared computer (i.e. the library, computer lab, or a work PC), log out of the shopping site and clear the browser history, cookies, and page cache.

This seems like a no-brainer, but if you’re using a shared machine, always log out of the store website and clear your browser’s page cache, cookies, and history when you are finished ordering something, or the next guy who sits down at the PC you were using might just have himself a little shopping spree on your dime.

7. Never give your social security number or birthday to any online retailer.

Vendors should never ask you for your social security number unless you are applying for in-store financing or something to that effect. If they are trying to require you to enter a social security number just to order a product, then they are most likely scammers. Run away fast. While your birthday may seem like an innocent enough piece of data to give out, it’s just one more of the three to four data elements needed by a scammer to steal your identity.

8. Find out the seller’s physical address.

If your seller is in a foreign country, returns and exchanges may be difficult or impossible. If the merchant only has a P.O. box listed, then that may be a red flag. If his address is 1234 in a van down by the river, you may consider shopping elsewhere.

9. Check out the seller’s return, refund, exchange, and shipping policies.

Read the fine print and watch out for hidden restocking fees, crazy high shipping charges, and other added fees. Beware of “coupon clubs” that the seller might try to get you to sign up for during your purchase. These clubs may save you a few dollars, but often they involve monthly billing for the privilege of joining.

10. Check the seller’s privacy policy.

While we might not think about it, some sellers resell our personal information, buying preferences, and other data to market research companies, telemarketers, and spammers. Read carefully and always make sure that you are opting-out and not opting-in when asked whether you want to have your information shared with “3rd parties” (unless you like a lot of spam in your e-mail). You may also want to obtain a separate e-mail account to use while shopping online to avoid clogging up your personal e-mail box with the barrage of sale ads and other junk mail that is frequently sent out.

Be smart, be safe, and know that there are groups such as the Internet Crime Complaint Center that can help you if you think you’ve been outright scammed.

Top 10 Tips To Secure Laptops For Airline Travel

Laptops are becoming more common than desktop computers. An increasing number of business and personal travelers bring along their laptops on flights. You should be prepared to remove your laptop from your laptop bag or carrying case to send it through the airport security checkpoint in its own bin. More importantly for travelers though is the need to protect the laptop throughout the trip. The very portability that make them such a convenient computing platform also makes them easy to lose and a prime target for theft. In order to protect your laptop and ensure it arrives at your destination in one piece and with the integrity of the data it contains still intact, you should follow these Top 10 tips:

1. Pad The Laptop: Make sure the laptop bag or carrying case you transport your laptop in provides adequate padding. As you move about the airport or shove the laptop under the seat in front of you or into the overhead storage compartment, the laptop can be jarred and jostled quite a bit.
2. Keep It On You: It is not uncommon for someone to set their luggage down while standing in line for a muffin, or to sit down while waiting for a flight. With all luggage, it is important to keep an eye on it and ensure nobody tampers with it or steals it. Because of their size and value though, laptops make prime targets and a thief can snatch the laptop bag and keep walking while you are unaware with your back turned. You should keep the laptop bag on your shoulder or keep it in sight at all times.
3. Back Up Data: Perform a backup of all critical or sensitive data before departing. Just in case your laptop does become damaged or lost, you don't want to also lose your important files and information. You can buy a new laptop, but it is much harder to replace lost data.
4. Encrypt Your Data: Just in case your laptop should fall into unauthorized hands, you should make sure your hard drive is encrypted. Laptops with Windows Vista Enterprise or Ultimate come equipped with BitLocker drive encryption. If you aren't using one of these versions of Windows Vista, and your company has not implemented any other sort of enterprise-wide encryption solution, you can use an open source solution such as TrueCrypt to protect your data.
5. Document Identifying Information: In case your laptop does end up lost or stolen, you should be able to provide detailed information about the make, model, serial number and any other identifying information. You may need the information to file a claim with the airline or your insurance company, or to provide law enforcement.
6. Use Strong Passwords: Follow the advice in Creating Secure Passwords to make sure that your passwords can not be easily guessed or cracked if your laptop falls into the wrong hands.
7. Use a BIOS Password: Protecting your laptop with an operating system login and password is a good idea, but there are ways to circumvent that protection and gain access to the data still. For better protection, you should enable password protection at the BIOS level so that the laptop can not even be turned on without the correct password.
8. Implement Remote Data Protection: Another step you can take to make sure your data does not fall into the wrong hands is to look into products that will allow you to remotely destroy or erase the data on your laptop if it is lost or stolen. These products generally require that the unauthorized user connect to the Internet first in order for them to do their work though, so they are not a guarantee.
9. Use Portable Storage: To make sure you have the business critical PowerPoint presentation or Excel spreadsheet that you need to show your business partners in order to seal the multi-million dollar deal (or whatever other important files and documents might be on your laptp) you should carry a copy on a USB thumb drive or some other type of portable storage that you can carry separate from the laptop in case it becomes lost or stolen.
10. Just Leave The Laptop At Home: When it comes to all of the hassles and all of the issues that can arise from traveling with your laptop, you should also consider whether you really need to take it. You can carry your data or files on portable storage such as a CD, DVD or USB drive, or you can just email or FTP the data ahead of you. Then, you can borrow a desktop or laptop system once you are safely on the ground and at the office site you are visiting.

Creating Secure Passwords

One of the problems with passwords is that users forget them. In an effort to not forget them, they use simple things like their dog’s name, their son’s first name and birthdate, the name of the current month- anything that will give them a clue to remember what their password is.

For the curious hacker who has somehow gained access to your computer system this is the equivalent of locking your door and leaving the key under the doormat. Without even resorting to any specialized tools a hacker can discover your basic personal information- name, children’s names, birthdates, pets names, etc. and try all of those out as potential passwords. 

To create a secure password that is easy for you to remember, follow these simple steps:

1. Do not use personal information. You should never use personal information as a part of your password. It is very easy for someone to guess things like your last name, pet's name, child's birth date and other similar details.
2. Do not use real words. There are tools available to help attackers guess your password. With today's computing power, it doesn't take long to try every word in the dictionary and find your password, so it is best if you do not use real words for your password.
3. Mix different character types. You can make a password much more secure by mixing different types of characters. Use some uppercase letters along with lowercase letters, numbers and even special characters such as '&' or '%'.
4. Use a passphrase. Rather than trying to remember a password created using various character types which is also not a word from the dictionary, you can use a passphrase. Think up a sentence or a line from a song or poem that you like and create a password using the first letter from each word. For example, rather than just having a password like 'yr$1Hes', you could take a sentence such as "I like to read the About.com Internet / Network Security web site" and convert it to a password like 'il2rtA!nsws". By substituting the number '2' for the word 'to' and using an exclamation point in place of the 'i' for 'Internet', you can use a variety of character types and create a secure password that is hard to crack, but much easier for you to remember.
5. Use a password management tool. Another way to store and remember passwords securely is to use some sort of password management tool. These tools maintain a list of usernames and passwords in encrypted form. Some will even automatically fill in the username and password information on sites and applications.

Using the tips above will help you create passwords that are more secure, but you should still also follow the following tips:

• Use different passwords. You should usea different username and password for each login or application you are trying to protect. That way if one gets compromised the others are still safe. Another approach which is less secure, but provides a fair tradeoff between security and convenience, is to use one username and password for sites and applications that don't need the extra security, but use unique usernames and more secure passwords on sites such as your bank or credit card companies.
• Change your passwords. You should change your password at least every 30 to 60 days. You should also not re-use a password for at least a year.
• Enforce stronger passwords: Rather than relying on every user of the computer to understand and follow the instructions above, you can configure Microsot Windows password policies so that Windows will not accept passwords that don't meet the minimum requirements.

8 Ways to Kid-proof Your Internet Parental Controls

Kids are more tech savvy than we can ever hope to be. We block a web site and they find a way around our blocking software. We put up a firewall, they go through it. What's a parent to do? We can never be sure that any of our parental controls will work, but we try our best to keep kids safe. Here are 8 things you can do to make your internet parental controls a little more effective and harder to circumvent:

1. Talk to Your Kids and set Boundaries and Expectations.

Let your kids know what is expected of them. Explain to them that you are trying to keep them safe and that you expect them to be responsible. Let them know that while you trust them, you will still verify that they are following the rules and that their online use can and will be monitored. Explain that internet access is a privilege that shouldn't be abused and that it can and will be taken away if they don't meet your expectations.

2. Physically Lock up Your Router.

One of the easiest ways for your child to circumvent your security settings is to reset your router to it's factory default settings. This usually involves simply pressing and holding a reset button located on the back of the router. Once the router is reset, most routers will default to wide-open wireless with no encryption, revert to an easily googled factory-set password, and have most of it's security features disabled. The kids have an easy alibi because they can plead ignorance and blame it on a power spike. Lock the router in a closet or somewhere way out of reach to prevent them from pressing the reset button.

3. Set Router-enforced Time Limits for Internet Access.

Most routers have a setting which gives you the ability to cut off access to the internet at a certain time of day. You lock your doors at night, right? Do the same for your internet connection. Go into your wireless router's setup and turn off your internet connection from midnight to 5 in the morning. The kids should sleeping during this time anyway. Time limits also prevent hackers from being able to attack your network during the set time-frame. You have effectively isolated yourself from the rest of the internet during the hours when most hackers are just starting on their second can of Red Bull.

4. Disable Wireless Remote Administration of Your Router.

If you turn off the "Remote Administration via Wireless" feature on your router, then someone trying to hack into it's settings (i.e. your child or a hacker) would have to be on a computer that is physically connected (via an Ethernet cable) to the router. Disabling this feature doesn't prevent you from being able to change your router's settings, it just makes it a little more inconvenient for you, your child, and hackers.

5. Scan for Unsecured Wireless Access Points Near Your Home.

All of your firewalls and filters go out the window if little Johnny attaches to your neighbor's unsecured wireless access point and starts leeching off of their internet connection. This essentially cuts your internet filters out because they are no longer in play as your child is using a different network entirely.

Use the Wi-Fi search feature of your Wi-Fi enabled cell phone or laptop to see if there are any open Wi-Fi hot spots near your house that your child could connect to. It's best if you do the search from inside their bedroom or wherever they normally get online from. You may be able to determine where the hot spot is originating from by looking at the signal strength meter as you walk around their room. Talk to your neighbor, explain your objective, and ask them to password protect their wireless access point. It not only helps you enforce your parental controls, it also helps keep people from getting a free ride courtesy of their unsecured Wi-Fi hot spot.

6. Enable the Parental Control Features on Your Child's Game Systems and/or Mobile Devices.

Parents often overlook the fact that their kids can get to the internet via their game consoles, iPods, and cell phones. These devices have web browsers just like your home PC does. The filters you install on your computer will do nothing to stop your kids from visiting forbidden sites using their mobile device or game system. Thankfully, most devices such as the iPod Touch and PlayStation 3 have parental controls that you can set to restrict the content that your kids can access. Read up on these features and implement them. Periodically check the device to see if the password you set is still in effect. If not, your child may have reset it and disabled the controls.

7. Put Their PC in an Open Area of the House That is Well Frequented.

It's hard for little Johnny to visit "bad" websites if he has to use the PC in the kitchen. If the PC is in a well frequented area where you can see it, your kids are less likely to attempt to go to unauthorized sites. Kids may love having a PC in their room, but consider moving it somewhere less private so you can keep an eye on what is going on. 

8. Enable Activity Logging on Your Router and PCs.

Your child will most likely figure out how to cover their tracks by deleting browser histories or by enabling "private browsing mode" where no history is kept. The best thing you can do is purchase monitoring software that is not easily defeated or detected by your child. Periodically review the log files to make sure your kids are staying out of trouble. Another option is to enable activity logging on your wireless router. Logging at the router will allow you to capture connection information even when your child is using their mobile devices or game consoles (unless they are using another wireless access point other than yours).

Administrator Password Hack

If you have lost the Administrator password, you must have the following to recover:

1. A regular user account that can logon locally to your Windows NT Workstation, Server, or PDC whichever you are recovering. If you already have an alternate install of NT, skip to The Process, Set 02.
    
2. The Windows NT CD-ROM and setup diskettes (winnt /ox to make them from the CD-ROM).
    
3. Enough room to install a temporary copy of NT (Workstation will suffice, even to recover on a PDC).
    
4. Your latest Service Pack.
    
5. The Process:
    
6. Install a copy of Windows NT as TEMPNT, on any drive. Install your latest Service Pack.
    
7. Boot the alternate install.
    
8. At a command prompt, type AT HH:MM /INTERACTIVE CMD /K where HH:MM is 10 minutes from now (or however much time you need to complete the remaining steps and logon to your primary installation).
    
9. Use Regedt32 to edit:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Schedule
    
10. Double click Schedule and click the one sub-key.
     
11. Double click the Schedule value name in the right hand pane and copy the REG_BINARY string to the clipboard.
     
12. Select HKEY_LOCAL_MACHINE and Load Hive from the Registry menu.
     
13. Navigate to your original installation\System32\Config folder and double-click System.
     
14. At the Key Name prompt, type ORIGSYS.
     
15. Navigate to ORIGSYS\Select and remember the value of Current; i.e. n.
     
16. Browse to ORIGSYS\ControlSet00n\Services\Schedule and if Start is not 0x2, set it to 0x2.
     
17. With Schedule selected, Add Key from the Edit menu.
     
18. Type 001 in Key Name and click OK.
     
19. Select 001 and Add Value name Command as type REG_SZ and set the string to CMD /K.
     
20. Select 001 and Add Value name Schedule as type REG_BINARY and paste the string from step 06.
     
21. Select ORIGSYS and Unload Hive from the Registry Menu.
     
22. Use Conrol Panel / System / Startup... to make your original install the default.
     
23. At a CMD prompt:
    attrib -r -s -h c:\boot.ini edit c:\boot.ini and either change the id of the TEMPNT lines to Maint 4.0 on both entries if you intend to keep this maintenance install or delete them. attrib +r +s +h c:\boot.ini
     
24. Shutdown and restart your original install.
     
25. Logon as your user account and wait for HH:MM from step 03.
     
26. When the CMD prompt opens, it will be under the context of the Schedule user, either the System account or an administrative account. If this machine is the NOT the PDC, type MUSRMGR.EXE, if it is the PDC, type USRMGR.EXE. If you get an error, click YES and type your domain name.
     
27. Set the Administrator password and logoff.
     
28. Logon as Administrator.
     
29. If you are deleted the TEMPNT entries in step 18, delete \TEMPNT
     
30. Promise To: Never forget the Administrator password again implement physical security.

Note: If the Schedule service runs under the context of a Domain Administrator on any member workstation, all you need to recover the PDC Administrator is a network login.

What is a 'Hacker'?

A hacker is a computer user who, for either negative or positive motivations, will manipulate and break into computer systems. You will see the "hacker" term spelled creatively in different ways, such as "haxor", "Hax0r", and "H4X0R", all of which mean the same thing.



Originally, a hacker of the 1980's was strictly evil and dishonest: a criminal who would illegally and unethically take control of computers and networks. And indeed, that criminal definition still applies today in the 21st century. However, the term hacker has also broadened to include non-criminal computer users. Today, "hacker" encompasses "black hat", "white hat", and "grey hat" computer users:

There are 3 modern types of hackers:

1. Black Hats: Criminal Hackers. Common job: Penetration Tester.
2. White Hats: Ethical Hackers. Common job: Network Security Specialist.
3. Grey Hats: Deals in both of the above (jack of all trades, master of none).

1) Classic "Black Hat" Hackers = Criminals/Lawbreakers
This is the classic definition of a hacker: a computer user who willfully seeks to vandalize or commit theft on other people's networks. This classic hacker is also known as a "black hat hacker" because of his malicious motivations. Black hats are gifted but unethical computer users who are motivated by feelings of power and petty revenge. They are electronic thugs, in every sense of the word, and share the same personality traits as punk teens who smash bus stop windows for personal satisfaction.

Black hat hackers are renowned for the following common cybercrimes:

• DOS/DDOS attacks that overload Internet servers.
• Defacing websites by hijacking control and replacing the main page photos with rude slogans.
• Performing identity theft by stealing private information of individuals.
• Botnetting: taking remote control of dozens of personal computers, and programming them to "zombie" as spam broadcasters.

2) White Hat "Ethical Hackers" = Network Security Specialists
Different from the classic black hat hackers, white hat hackers have honorable, or at least benign, motivations. A white hat "ethical hacker" is a talented computer security user employed to help protect computer networks. These white hats are not unlike former convicts who take on work as store security guards. While they themselves may not be completely ethical, their vocation is considered white hat. Ethical hackers are usually motivated by a steady paycheck. It is not surprising to see ethical hackers spending those paychecks on very expensive personal computers in their personal lives, so they can play online games after work. As long as they have a good-paying job to support their personal habits, an ethical hacker is usually not motivated to destroy nor steal from their employer.

Related: White Hat "Academic Hackers" = Creative Computer Artists
Another kind of white hat is the "academic hacker": a computer artisan who is not interested in protecting systems, but rather in creating clever programs and beautiful interfaces. If you are an academic hacker, for example, you will take existing programmatic code, and improve upon it through clever alterations and additions. "Academic hacking" is about obsessively innovating computer code so that it becomes more beautiful or more efficient as a program. Academic hackers, in general, are harmless and do not seek to hurt other people's networks. Academic white hats are often graduate students in computer programming.

3) Grey Hat Hackers = Uncertain which side of the law to stand for.
Grey hats are often "hobby hackers": users with basic or intermediate tech skills who like to disassemble and modify their own computers for hobby pleasure, and who also dabble in minor white collar crimes, like file-sharing movies or cracking software. Yes, millions of p2p downloaders are hobby hackers. And indeed, if you have ever modified your router and firewall to allow faster p2p downloads, you could describe yourself as a "grey hat" hobby hacker. Gratefully, only a small percentage of hobby hackers ever escalate into becoming serious black hat hackers.