Posts tagged with “password”

Tips for creating strong password

Wednesday, 22 December, 2010

This post is from Help Net Security, a great resource for News, Articles and information on Security. Visit Help Net Security and subscribe or follow their tweets. This post is located here.

To ensure consumers stay safe online and enjoy this holiday season, Check Point outlines practical tips for creating a strong password.

  • Choose a password that is at least 8 to 10 characters long. This should be long enough to prevent brute force attacks. Since brute force attacks consist of trying every possible code, combination, or a password until the right one is found.
  • Make sure your password is difficult to guess. Do not use names of any kind, including your login name, family member’s name or a pet’s name. Also avoid using personal information such as a phone number, birthday or place of birth.
  • Avoid words that can be found in the dictionary. With the availability of online dictionaries it is easy for someone to write a program to test all of the words until they find the right one.
  • Stay away from repeated characters or easy to guess sequences. For example: 77777, 12345, or abcde.
  • Choose a password that is a mixture of numbers, letter and special characters. The more complex and random it is the harder it will be for a malicious person to crack.
  • Use fragments of words that will not be found in a dictionary. Break the word in half and put a special character in the middle.
  • Choose different and unique passwords for all of the important sites.
  • Change your passwords often. Even if someone cracks the system password file, the password they obtain is not likely to last long.
  • Use a reliable password protection solution.

To get more insight on how people create poor passwords, take a look at this analysis of 32 million breached passwords.

Understanding PHARMING

Tuesday, 17 March, 2009

pharmingA follow up on my previous entry about Phishing, here comes another threat on the Net – Pharming. As discussed earlier, phishers bait potential users with genuine looking email to convince victims by taking action to expose critical or personal information. A typical example is an email requesting you to update your password or provide your bank account information. Or asking you to click on the link to update your data. Be aware that banks do not email their customers asking them to change their password or provide their PIN or confidential data. They have better and more secure communication channels to acquire those.

But here comes the joy, or the trouble in this case. Pharming attacks usually do not require convincing emails. It is also more wide-coverage than phishing. While phishing trick victims using a genuine looking emails or links, pharming goes deeper underground in planting a seed for its farm err, pharm?

Pharming cultivation

The technique used in Pharming is not new. In fact it had been around for long. The difference, however, is the intention. They want your identity or data. Pharming takes advantage of hacking DNS (Domain Name Server) such as cache poisoning, spoofing, and hijacking. Let’s see how this works.

How Pharming Works

How Pharming Works

  1. An attacker exploits vulnerabilities of a DNS. Using crafted responses or take advantage of a vulnerability, an attacker can poisoned the DNS cache and can change valid entries. Internally, a disgruntled engineer can even manipulate the host lookup on these servers. Externally, attackers can take advantage of the operating systems vulnerabilities.
  2. A user wants to go to a website securetoday.net and enter in the browser.
  3. The user’s computer queries the DNS to resolve the site. Now, DNS being poisoned resolved the site to the nefarious fake website and redirected to securetodat.net.
  4. User unaware of what happened thinks he is on the correct website.

Of course, the fake website has to be designed as close as possible to convince the victims that they are on the correct website. On the website, they can ask the user to login, provide confidential information, and more.
Read the rest of this entry »

Secure your PASSWORD

Saturday, 14 February, 2009

PASSWORD MANAGEMENT

One of the overlooked area many of us struggle with is password management. In our day to day computing activities, many of us would simply just use or chose to protect our assets with a simple password. These assets could be critical such as bank accounts, confidential data, or even health information. We are lacking the real work on password management.

passwordNow, just what is password management really is? Well, in its very simplest form, managing passwords!

In corporate world, there are various technologies that does password management. In fact, password management is covered in a good scope on many of books for the CISSP exam.

Now, before going deeper to it, let’s magnify our glass to the word password itself. Many, if not all of us know what password is. That’s the word you write on your sticky note and hide it underneath your keyboard. Kidding aside.

Password is the most widely and commonly used authentication mechanism. They are also considered the weakest security mechanism. Users would simply choose very easy passwords such as their date of birth, favorite color, their nickname, etc., that are easy enough to guess. Sometimes too, they give it away to their buddies or best friends.

It is funny yet interesting to see how users typically thinks security is not one of the most important part of their computer. Not until someone hacks into their computer or account, then that’s when security is all the frustrations.

So here comes password management to the rescue. Although the scope of this article will dive only deeper to day-to-day users of computers, emails and services; it will touch a bit on the corporate world where I will cover some of the best ways in managing password. Bear in mind, this article does not go deeper in how to implement SSO technologies or token devices and such.

Read the rest of this entry »

Protection against Phishing

Friday, 5 December, 2008

phishing2

PHISHING is a social engineering technique, which means to trick someone into believing something but different to what it really means, with a full purpose of obtaining personal information, credit card information and credentials.

The word phishing has been around since 1996. It was originally coined by hackers who started stealing AOL passwords by posing as a staff member and sending email messages to victims asking them their account information to verify their billing information and other information about their AOL accounts. The attacker lure, or fish the victims. This is when the word phishing began.

Although this social engineering technique had been around since the ’90’s it did not hit its popularity until the mid-2003. Phishing attackers, also called phishers creates very convincing emails requesting victims to click on links to update their account information. These emails and the redirecting website looks very closely similar to the actual website. Too convincing enough, a typical user would not spot the differences.

Some of the few tricks that these phishers would manipulate is to ask you to click on the link inside the email with a link almost the same as the actual website. For example, if you have an account with Bank of Alaska and their website is bankofalaska.com, they would create a site something like backofalaska.com. Or they would place @ symbol like bankofalaska.com@oursite.com. Before the @ sign would be the username following the http protocol. The actual website is oursite.com, which is a bad site. Depending on the way the site is written, the username can be ignored if it is not required.

Read the rest of this entry »