WordPress Security Plugins - Half the Battle

You might think that installing a few WordPress security plugins does the entire job of protecting your site. Security plugins can help make your site safer (i.e. database backups, login lockouts). Most people don't realize that there's much more involved in order to protect a WordPress blog.

Gmail Login Security Tips

Google's systems are subject to cyber attacks just like every other email server. The best way to counteract the threat of this breech of security is to keep up to date with the Gmail security features and suggested actions.

The easiest step toward ensuring your Gmail log in information is secure is to simply not give it out. Emails you receive asking for your personal log in information should be ignored. Gmail, nor any other company or server, would solicit this information directly from users. Also, you should change your password regularly. Gmail recommends you change your password at least twice a year without repeating the same code in the same six month span.

Tips For Creating Strong and Secure Passwords

Computer hacking happens when hackers who know your password do not have to resort to technological exploits, instead they can log on and do anything that you can do on the computer or network. Keeping your password secret is one of the most important things you can do to in information security to protect your computer against security breaches.

The first step in information security is creating strong passwords that cannot be easily guessed or deduced. Tips for creating strong passwords include the following: Do not use personal information for your password. Social security numbers, driver's license numbers, phone numbers, birth dates, spouse names, and pet names are all factual information that can be found out by others.

Is Shopping Online For Your Horse Gifts Safe?

Shopping for horse gifts or other gift items on the internet
is quick, convenient and is probably safer than you think.
However, you still need to be aware that it is essential to
vigorously protect your privacy and financial information
when making purchases online.

If you take the necessary precautions to protect
yourself when shopping for those special gifts for horse
lovers, it should be no riskier than buying by mail order or
over the phone.

To make your shopping experience a safe and happy one, the
Following suggestions may be of help:

1. When shopping, always be sure that the Web site is secure
before you provide any financial information, like your bank
account number or credit card information.

Secured Web sites will use encryption to scramble your
information when transmitted over the Internet.

There are a couple of ways for you to identify if a Web site
is secure.

a. A Web site address that is secure is preceded by "https".
For example,https//www.secure-site.com.The letter s at
the end of http indicates that Web site is secure.

b. Look for a yellow or golden closed lock or an unbroken
key at the bottom of your browser window.

Web sites may use other symbols to indicate their Web
site is secure, so if you don't see the two symbols
mentioned above continue to investigate and see if you can
locate other symbols or information indicating their Web
site is secure.

2. Still uncomfortable with providing your billing
information over the Internet? Then you might want to ask
the business you're shopping if they use alternate methods,
such as the telephone.

3. Whenever possible, it is recommended paying by credit
card; this will offer you added protection if a dispute
should arise.

4. If you prefer not paying by credit card, request that
your purchase be sent C.O.D. You can make your payment by
check or money order, this is easier to trace than cash. It
is probably a good idea that you never pay in cash for
obvious reasons.

5. Some businesses display the Better Business Bureau logo
on their Web Site, others do not. If you're not feeling at
ease, consider checking with the Better Business Bureau for
a reliability report. The report will include such
information as; the length of time the company has been in
business, the company's complaint history and whether
the business participates in BBB programs, such as dispute
mediation.

6. If you shop online auctions, be sure you exercise the
same good sense you use for your other transactions. Do your
homework. Check the "feedback" areas of online auction
sites; most of the time they are a good source for getting
information about other buyers' who have purchased from the
seller. You can always check with the Better Business
Bureau nearest the seller for any complaints if the seller
is a business.

Copyright © Mike Gorzalka All Rights Reserved Worldwide.

The Roundup puts out a blockbuster newsletter which offers
some *great* information on every thing form shopping to
horsemanship and you.

You can subscribe here,

The Roundup or

Perfect-Horse-Gifts.com


You have permission to publish this article

electronically, in print, in your ebook or on your web site,

free of charge, as long as the content of this article is

not altered in any way and the author bylines are included.


If you choose to publish this article I would appreciate a

Quick e-mail letting me know where it will be published.

http://www.mike@perfect-horse-gifts.com or

Mike@perfect-horse-gifts.com

DISCLAIMER: The information contained in this article is

of my personal opinions and beliefs and should not be taken

as anything more.

Can I Guess Your Password?

We all know that it’s dangerous to use the same password for more than one program. If you sign up for a program run by someone of low moral fibre, what is to stop them running through various programs with your username and password to see what they can access?

But of course remembering all the different passwords can be a headache. And writing them down somewhere isn’t a great deal safer than using the same password again and again.

You can buy software that stores the passwords for you, but do you really want to pay money for another piece of software that performs a solitary function?

Try this simple, two-step, technique that lets you generate an infinite number of passwords, without having to remember any of them.

Step One: Choose a 4-6 letter word or number sequence that you can remember easily. Needless to say, don’t reveal this to anyone. For the purpose of this demonstration, I’ll choose the word "cash"

Step Two: Apply this secret word or number sequence to the name of the program you are setting up the password for.

To accomplish this, invent a couple of easy to remember rules.

Rule 1: Decide which part of the program name you are going to use. It could be the whole name, the first 6 letters of the name, the last 8 letters of the name. It’s totally up to you, be as creative as you like.

eg – For the program TrafficSwarm, I might choose the first 8 letters of the name. This give me: "traffics"

Rule 2: Take the portion of the program name you have selected and merge it with your secret word or number sequence to create a unique password. Again, be as creative as you can with this rule. You could replace every second letter, every third letter, every vowel or every consonant.

eg – If I replace every second letter of "traffics" with my secret word "cash", I get " t c a a f s c h "

or

- If I replace every vowel of "traffics" with my secret word "cash", I get " t r c f f a c s ". The "s" and the "h" are not used as "traffics" has only two vowels, but some words will use all four letters of "cash". Some words might have more than four vowels, in which case just start back at the beginning with "c" and "a" and so on…

You don’t have to worry about making your rules overly complex. Even the best code-breakers would need to see several of your passwords before they could start to guess what you rules are.

As long as you keep your rules safe and sound, your password is secure. But the real beauty of this system, is that you don’t have to remember the passwords you create. You ONLY have to remember the rules.

When you log into the program the next time, just apply your rules to the program name, and you can work out what password you generated. Once you have been using the rules for a while, you’ll generate the password in your head, without even having to pause.

Don’t worry if it seems a little complicated at first. Read this article through a couple more times and then try this technique with just a couple of programs. Once you are happy with it, all that’s left to do is to start working your way through existing programs and update your passwords. It’s time consuming, but for peace of mind you’ll be glad you did.

Don't Miss Information Because of Misinformation

It has been said that with the wealth of information, freely available, the Internet has the ability to make you smarter, faster, than any other medium on the planet.

Of course with an equal amount of mis-information, it also has the ability to make you dumber, faster, than any other medium on the planet.

So how do you decide which sources of information to trust and which sources to avoid?

It has long been a source of debate, whether or not, any information can be 100% reliable. There is, it is said, no such thing as absolute truth (is that an absolute truth?).

Really though, there is no point in driving yourself mad with such trivial philosophies. All you have to do is decide, in your own mind, where your level of skepticism begins and ends. And skepticism is important in this day and age. That isn’t a negative viewpoint, it’s just a realistic assessment of what you need to survive.

Imagine for a moment that you're looking for a solution that will send your weekly newsletter to your eagerly awaiting mailing list. You can choose from a myriad of different software, hardware, third-party solutions. Some free, some cheap, some expensive and some unreliable. A decision has to be made. Who’s going to help you? Look at the options.

SPAM: Lots of unsolicited emails promise to have the definitive solution and at one time this might have been worth a look. Today, however, if a company is so discourteous that they ignore the generally accepted rules of spamming do you really want to do business with them?

Verdict: Dubious

WEBSITE: Ranked high on Google, plenty of glowing testimonials, even a 30 day money-back guarantee. But wait! Are those testimonials real or fictitious? Is there a clause that will prevent you from returning the product if you dislike it? Can you really believe anything you are being told?

The reality is, that many companies will say anything to make a sale. This is true both on the Internet and the High Street. Desire for profit can quickly deteriorate good intentions. I don’t need to preach about this. You know it’s true.

Accept this, then temper your paranoia by checking the facts. Legitimate companies exist on the Internet by the thousand. The ones worth buying from will happily talk to you on the phone and answer your questions in person. They will respond to your questions by email, probably on the same day. And, if they’re really worth spending money on, they will let you personally contact previous customers so you can confirm that what they’re saying is true.

Make the company work for the sale. If they can’t be bothered to reply to your emails or turn the answering machine off, don’t bother to give them your credit card number.

Verdict: Tread carefully

RECOMMENDATIONS: The product/service is recommended by a third party, perhaps in an ezine, or on a website. Sounds great? A genuine testimonial? But wait!

What is the recommender’s motive?

Love for fellow man?

Appreciation of the product?

Cash?

If you picked option number 3, you’re probably right. Joint ventures and affiliate programmes have led to many a recommendation of a product/service that hasn't been evaluated or even used. There are exceptions but there’s a good chance that the recommendation is linked to a commission.

This doesn’t, by itself, mean the testimonial is bogus. It simply means, as previously stated, that you should use some skepticism.

Look for recommendations from newsletters or websites that have been around for some time. If they have a reputation to consider, they will (should?) think twice before promoting something they haven’t fully investigated.

Verdict: Useful, be sure about the source

SEARCH ENGINES: Once you’ve found the product/service that sets you alight, look for negative feedback. Search for the product name alongside words like "hate" or "problem".

If lots of people have used this product and had problems, then at least few will likely have posted their experiences on a forum.

If no results appear, take this as a good sign and move on.

Verdict: Essential step

FORUMS: If you're really having difficulty finding what you are looking for, forums could be the key.

Look around for about half a dozen forums that you like and have plenty of traffic. Then post a description of what you need on all of them. Check back frequently and see what comes up.

Forums are an excellent way to find uncensored information offered solely for its value. Generally speaking, what you see is what you get.

There are, of course, exceptions. Occasionally someone might recommend something, solely because they are affiliated in some way. But if the forum is busy enough, they probably won’t get away with it.

Verdict: About as safe as you can hope to find

Does the above sound obvious to you? Maybe it is, but every day hundreds or even thousands lose money on poor or useful products/services that they were convinced were perfect. If you doubt it, check through a few related forums.

If you run your own ezine/website/forum, ask yourself what you can do to help those who aren’t as experienced. Your honesty will set you apart from the rest.

If all of this seems helpful, all well and good. Your final task is to apply the above information to this article and ask yourself, with just a touch of skepticism:

"Is it information or misinformation?"

Passwords or Pass Phrase? Protecting your Intellectual Property

Much has been said on the theory of password protection for files, computer login, and other network access. In the past we used a combination of letters, special characters, and other techniques to try and prevent unwanted or unauthorized access to our computers, resources, and networks. A new theory on passwords is emerging that may help us remember our access codes, be more secure, and generally keep hackers and thieves out of our networks.

A password is a combination of words, letters, and special characters that only the user knows, allowing access to a computer or other information resources. As humans we have a large number of codes and numbers we need to remember every day – such as the key lock on our apartment entries, national identification numbers, automobile license or tag numbers, telephone numbers – it is a large and confusing suite of items we need to memorize.

When selecting a new password or pass code for access to a computer system, most of us understand how difficult it is to remember complex codes, and thus we select something already know n to us, such as names, birthdays, national identifiers, or other known items, and then place a number or character in front of the name or number thinking it is secure. This is easy to understand, as most of us simply do not have an ability to instantly recall large numbers of complex codes.

In a worst case we simply write down the complex code on a piece of paper, and leave it in a desk, our pocketbook, or in many cases taped to the front of our computer monitor.

However, to a hacker this makes access to your network or computer much easier, at they generally only have to learn a couple things about you, and add a few numbers to the front or ending of your personal data – you would be surprised how often this grants access to computers and networks. Ad some good “cracking utilities” to the hacker’s suite of tools, and you can understand the threat.

PassPhrases are a concept that will help us create more secure, easy to remember safeguards for our computer and network resource protection. A passphrase is a selection of words and/or numbers that are 15 characters or more in length, and are easy for us to remember. A couple examples of a good pass phrases are:

• igotodalaieejdaily

• shehasbeautifulhair

• surfinginhawaiiisgreat

According to Mark Minasi, a noted security consultant, a 15 character pass phrase will require a cracking program the following number of computations to try and break a 15 character pass phrase:

• 15 lowercase letters = 1,677,259,342,285,725,925,376 possibilities

• Try a million a second, it’ll take 531,855 centuries/years to break the code

As you can see, this is a pretty good level of security for your resource.

Another concern with passwords is if you forget or lose the password, and are using a utility like Microsoft’s Encrypting File System (EFS), you run the risk of losing all access to your important files if you require a hardware reset of your password. All EFS encrypted files are linked to your login profile, meaning if you encrypt a directory or file with EFS, and you do a hardware reset on your computer, those files and directories are lost FOREVER.

For Microsoft Windows users you can now also use spaces within your pass phrase, however we would not recommend embedding spaces in your pass phrase, as that actually does allow a cracker better access to getting your code – it may help them crack it in 100,000 years rather than 250,000!

DOS Attacks: Instigation and Mitigation

During the release of a new software product specialized to track spam, ACME Software Inc notice that there was not as much traffic as they hoped to receive. During further investigation, they found that they could not view their own website. At that moment, the VP of sales received a call from the company's broker stating that ACME Software Inc stock fell 4 point due to lack of confidence. Several states away, spammers didn't like the idea of lower profit margins do to an easy to install spam blocking software so they thought they would fight back. Earlier that day, they took control of hundreds of compromised computers and used them as DoS zombies to attack ACME Software Inc's Internet servers in a vicious act of cyber assault. During an emergency press conference the next morning, ACME Software Inc's CIO announced his resignation as a result of a several million dollar corporate loss.

Scenarios like the one above happen a more then people think and are more costly then most will admit. Denial of Service (DoS) attacks are designed to deplete the resources of a target computer system in an attempt to take a node off line by crashing or overloading it. Distributed Denial of Service (DDoS) is a DoS attack that is engaged by many different locations. The most common DDoS attacks are instigated through viruses or zombie machines. There are many reasons that DoS attacks are executed, and most of them are out of malicious intent. DoS attacks are almost impossible to prevent if you are singled out as a target. It's difficult to distinguish the difference between a legitimate packet and one used for a DoS attack.

The purpose of this article is to give the reader with basic network knowledge a better understanding of the challenges presented by Denial of Service attacks, how they work, and ways to protect systems and networks from them.

Instigation:

Spoofing - Falsifying an Internet address (know as spoofing) is the method an attacker uses to fake an IP address. This is used to reroute traffic to a target network node or used to deceive a server into identifying the attacker as a legitimate node. When most of us think of this approach of hacking, we think of someone in another city essentially becoming you. The way TCP/IP is designed, the only way a criminal hacker or cracker can take over your Internet identity in this fashion is to blind spoof. This means that the impostor knows exactly what responses to send to a port, but will not get the corresponding response since the traffic is routed to the original system. If the spoofing is designed around a DoS attack, the internal address becomes the victim. Spoofing is used in most of the well-known DoS attacks. Many attackers will start a DoS attack to drop a node from the network so they can take over the IP address of that device. IP Hijacking is the main method used when attacking a secured network or attempting other attacks like the Man in the Middle attack.

SYN Flood - Attackers send a series of SYN requests to a target (victim). The target sends a SYN ACK in response and waits for an ACK to come back to complete the session set up. Instead of responding with an ACK, the attacker responds with another SYN to open up a new connection. This causes the connection queues and memory buffer to fill up, thereby denying service to legitimate TCP users. At this time, the attacker can hijack the system's IP address if that is the end goal. Spoofing the "source" IP address when sending a SYN flood will not only cover the offender's tracks, but is also a method of attack in itself. SYN Floods are the most commonly used DoS in viruses and are easy to write. See http://www.infosecprofessionals.com/code/synflood.c.txt

Smurf Attack- Smurf and Fraggle attacks are the easiest to prevent. A perpetrator sends a large number of ICMP echo (ping) traffic at IP broadcast addresses, using a fake source address. The "source" or spoofed address will be flooded with simultaneous replies (See CERT Advisory: CA-1998-01). This can be prevented by simply blocking broadcast traffic from remote network sources using access control lists.

Fraggle Attack - This types of attack is the same as a Smurf attack except using UDP instead if TCP. By sending an UDP echo (ping) traffic to IP broadcast addresses, the systems on the network will all respond to the spoofed address and affect the target system. This is a simple rewrite of the Smurf code. This can be prevented by simply blocking broadcast traffic from remote IP address.

Ping of Death - An attacker sends illegitimate ICMP (ping) packets larger than 65,536 bytes to a system with the intention of crashing it. These attacks have been outdated since the days of NT4 and Win95.

Teardrop - Otherwise known as an IP fragmentation attack, this DoS attack targets systems that are running Windows NT 4.0, Win95 , Linux up to 2.0.32. Like the Ping of Death, the Teardrop is no longer effective.

Application Attack - Thess are DoS attacks that involve exploiting an application vulnerability causing the target program to crash or restart the system.

Kazaa and Morpheus have a known flaw that will allow an attacker to consume all available bandwidth without being logged. See http://www.infosecprofessionals.com/code/kazaa.pl.txt

Microsoft's IIS 5 SSL also has an easy way to exploit vulnerability. Most exploits like these are easy to find on the Internet and can be copied and pasted as working code. There are thousands of exploits that can be used to DoS a target system/application. See http://www.infosecprofessionals.com/code/IIS5SSL.c.txt

Viruses, Worms, and Antivirus - Yes, Antivirus. Too many cases where the antivirus configuration is wrong or the wrong edition is installed. This lack of foresight causes an unintentional DDoS attack on the network by taking up valuable CPU resources and bandwidth. Viruses and worms also cause DDoS attacks by the nature of how they spread. Some purposefully attack an individual target after a system has been infected. The Blaster worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135 is a great example of this. The Blaster targeted Microsoft's windows update site by initiating a SYN FLOOD. Because of this, Microsoft decided to no longer resolve the DNS for 'windowsupdate.com'.

DoS attacks are impossible to stop. However, there are things you can do to mitigate potential damages they may cause to your environment. The main thing to remember is that you always need to keep up-to-date on the newest threats.

Mitigation:

Antivirus software - Installing an antivirus software with the latest virus definitions will help prevent your system from becoming a DoS zombie. Now, more then ever, this is an important feature that you must have. With lawsuits so prevalent, not having the proper protection can leave you open for downstream liability.

Software updates - Keep your software up to date at all times. This includes antivirus, email clients, and network servers. You also need to keep all network Operating Systems installed with the latest security patches. Microsoft has done a great job with making these patches available for their Windows distributions. Linux has been said to be more secure, but the patches are far more scarce. RedHat is planning on incorporating the NSA's SE Linux kernel into future releases. This will give Mandatory Access Control (MAC) capabilities to the Linux community.

Network protection - Using a combination of firewalls and Intrusion Detection Systems (IDS) can cut down on suspicious traffic and can make the difference between logged annoyance and your job. Firewalls should be set to deny all traffic that is not specifically designed to pass through. Integrating an IDS will warn you when strange traffic is present on your network. This will assist you in finding and stopping attacks.

Network device configuration - Configuring perimeter devices like routers can detect and in some cases prevent DoS attacks. Cisco routers can be configured to actively prevent SYN attacks starting in Cisco IOS 11.3 and higher using the TCP intercept command in global configuration mode.

Access-list number {deny | permit} tcp any destination destination-wildcard ip tcp intercept list access-list-number ip tcp intercept ? (will give you a good list of other options.)

Cisco routers can prevent Smurf and Fraggle attacks by blocking broadcast traffic. Since Cisco IOS 12.0, this is the default configuration. ACLs or access control lists should also be configured on all interfaces.

No ip directed-broadcast

The Cisco router can also be used to prevent IP spoofing. ip access-group list in interface access-list number deny icmp any any redirect access-list number deny ip 127.0.0.0 0.255.255.255 any access-list number deny ip 224.0.0.0 31.255.255.255 any access-list number deny ip host 0.0.0.0 any See Improving Security on Cisco Routers - www.cisco.com/warp/public/707/21.html

Old Cisco IOS versions are vulnerable to several DoS attacks. The "Black Angels" wrote a program called Cisco Global Exploiter. This is a great software to use when testing the security of your Cisco router version and configuration and can be found at http://www.blackangels.it/Projects/cge.htm

Security is not as mystical as people believe. DoS attacks come in many different types and can be devastating if you don't take the proper precautions. Keep up to date and take steps to secure network nodes. Keeping security in mind can minimize damages, downtime, and save your career.

Security Resources:
Black Angels: http://www.blackangels.it/
Cisco: http://www.cisco.com
Microsoft: http://www.microsoft.com/technet/security/current.aspx
Forum of Incident Response and Security Teams: http://www.first.org/
SANS Institute: http://www.sans.org/resources/

Secret Tips To Prevent Phishing Attack

If you use your credit card online, then you're exposed to phishing attack. It's not just credit card users, but others who always entering their information through the Internet are also exposing themselves to this type of threat.

Phishing is define as stealing sensitive information using social engineering tactics. The phishers will attempt to duplicate trusted websites to retrieve your information.

Recently, researchers have found that the phishers can used a domain trusted by phishing filters to retrieve information from innocent users. This can become a headache because this attempt can bypass anti phishing filters and steal your information with the anti-phishing software installed.

How we can avoid this from happening? Nowadays, even trusted domain cannot be trusted.

I would like to suggest you to be very careful when entering your information to any website. Especially the websites that you do not trust.

If you're using the Internet Explorer 7, it has a built-in phishing filter. This built-in phishing filter can checks whether the website you're visiting is a suspicious website or not. But, don't rely on this filter too heavily.

Install a third-party anti-phishing software. It can help to protect you from phishing website. One anti-phishing software that I recommend is CallingID.

Remember to not click the link inside any emails you receive asking you to log in. If you receive an email asking you to update your banking information or something like that, type the URL directly to the web address. Do not click the link provided in the email. For example, if you receive an email from Paypal asking you to log in, type the Paypal URL directly to the web address instead of using the link provided in the email.

This can prevent phishers to steal your user name and password.

Everyday there will be attempt to steal our information and if we let our guard down, we might become their next victim. Before this happened, remember to take all the security measures that you know.

Even though we cannot have a water-tight security, but,it's best to take all the security measures that we can afford rather than have nothing against the phishers.

Azwan Asmat is the author of Chuang Computer Tips Want to know the secret of securing your PC from dangerous spyware, adware, and malware programs that can ruin your PC, your finances, and your sanity?!! Visit PC Safety 101 for more info.

Article Source: http://EzineArticles.com/?expert=Azwan_Asmat