Thursday, March 23, 2006

Anatomy of Computer Hacking Over The Internet

Working in banking and government security environments gave me
a good look at what happens during an Internet hacking attack.
Less advanced hacks are watched and stopped in many cases. Since
these happen most often, more is known about them. To a large
extent, Internet hacking is predictable because it follows
specific patterns, which basic security tools detect.

In the next four issues of Protect-My-Info, I'm going to
describe in simple terms how computers get hacked on the
Internet and what you can do to stop these attacks.

If you've already taken the right steps - bonus! If not, you
might want to get on it fast! This means anytime you type
personal information into a computer.

Now back to the hacking attack...

For this article, Internet hacking describes someone on another
computer trying to break into yours over a public network.
There are other ways to hack computer, but we'll stick to
this common notion for now.

Internet hacking usually follows this order: reconnaissance,
research, and then attack.

Everyone on the Internet has a unique identifying number known
as a network address. There's over 4 billion possible addresses
on the Internet, and the hack begins with a scan of those
addresses.

You're among the four plus billion the moment you connect your
computer to the Internet.

Four billion might seem like a lot of addresses but I assure
it's not. The Internet is already running out of available
addresses, and scanning can happen fast. In a controlled high-
speed network, hundreds of unprotected computers can be scanned
in mere seconds.

Don't think an unprotected computer won't go unnoticed because
it's hidden in the crowd of four billion. It doesn't work that
way - the unprotected computer will eventually be discovered.

Now think of the network addresses as street addresses. Each
address represents a home, a building or empty plot of land.

Each address has ports too. These ports exchange information
between the Internet and your computer programs.

Programs like your web browser and e-mail use unique ports.

If network addresses are like street addresses, ports are
like apartment building suite numbers.

There's one building to each street address, but different
people might live in each apartment suite at that address.

In the apartment analogy, the network scan equals to a stranger
who walks from building to building, checking every front door.
If he gets in, he can walk through the apartment hallways to
rattle the doorknob of each suite to see if anybody's home
and to observe ways to get in.

In essence, the Internet scan can be likened to the stranger's
visit to your front door, and doorknob rattling. This
reconnaissance precedes an attack in that weaknesses and
opportunities are noted.

As reconnaissance acts as the early gathering of information,
it's only the first step. They'll be back for another visit...

In the next issue, we'll look into the research that happens
before the attack.

Until next time, stay smart and be safe.

Tuesday, March 21, 2006

Identity Theft Widens

Good grief. The definition of "Identity Theft" keeps growing.

This time Network Solutions does injustice by selling its domain privacy service on the back of the household identity theft scare.

If you search Google for "identity theft protection" you'll see Network Solution's ad "Request Domain Names Now & Get The Name You Want."

You see, Network Solutions now charges $9 a year to keep Internet domain (i.e. protect-my-info.com) contact information private.

The first problem with this is there's no "identity theft" when someone sees your contact info for your domain registration. It's public information. This is like the telephone company telling you that you've been hit with identity theft because someone found you in the phone directory, and you should pay $9 to delist for privacy.

The second problem is companies shouldn't be allowed to keep personal information private. Although the info Network Solution's dealing with isn't that personal, institutions in general should keep certain personal details belonging to other people private.

If an institutions collects your personal info like SSN or health records for instance, the institution should do whatever can to protect that info - not sell it or carelessly lose it.

There was a time when personal info was sold like sports trading cards. A number of states sold voter registration info at one time - with SSN's for example. That's stopped, but we still have a way to go before the mess is cleaned up.

Sunday, March 19, 2006

Anonymous in MyPlace

From teens to GenX'ers, people flock to MyPlace today as the hot meeting space on the web. Everyone's talking about it. It's reached such a boiling point that Playboy's picked up on it. Even Jon Stewart fired off his usual satire over MyPlace on his Daily Show.

You know you've hit big time when you've got Playboy and The Daily show's attention.

On MyPlace, you can tell others about yourself and make new "friends." You can tell the truth or hide behind a fictitious persona. Heck, you can even put up someone else's photo and say it's you - even if it's someone of the opposite sex and twenty years younger.

It can even be fun and amusing for some folks to act out different personae online. It's IRC and online chat rooms replayed in 2006.

There you are, talking to other people around the world, and exchanging photos with hundreds... maybe thousands of newfound "friends." Friends you don't know for real, but what does it matter? No one's checking. Harmless. Yes?

Not exactly. Not when anonymous sex predators lurk in the darker corners of cyberspace... looking for easy targets among kids and teens.

My 11-year old niece Sonia goes online occasionally, and I shudder to think of some strangers she might meet.

I'd do everything I can to keep someone like a thirty year old sex pervert hiding behind a facade from luring her deeper into his world.

Off-line, some cities keep track of convicted child molesters in the general population. The molesters don't get to disappear into the crowd.

Online, some people do things they wouldn't do in person.

Although anonymity can be good, it has drawbacks too. Anonymity opposes accountability, which legal identity serves to preserve.

Without accountability, more people would commit crimes if they knew they won't get caught.

In a nuteshell, it's best to know how to balance anonymity and accountability when you need to protect your interests. Anonymity and accountability can work for and against you.

Wednesday, March 15, 2006

Anonymous Identity

"On the Internet, Nobody Knows You're a Dog"

Is that the case? Should it be?

In July 1993, The New Yorker (Vol.69 no. 20) published Peter Steiner's now famous cartoon "On the Internet, Nobody Knows You're a Dog."

This cartoon held that people can roam online anonymously. Perhaps back then. The question today is whether that is the case, and if so, should it be?

When looking at such online meeting place phenomena's like MyPlace, one must wonder if anonymity is good. I mean we can't have anonymity for ecommerce like banking to prevent identity theft. What can problems come out meeting anonymous people online?

Stay posted here to find out the pros and cons of anonymity on identity theft.

Sunday, March 12, 2006

Beware Of What Lies Beneath The Identity Theft Message

If you type in "identity theft" on Google today, you'll find one of the big consulting firms advertising its services under the "identity theft" guise.

The sad truth is the consulting service caters to big companies able to pay $1000 - $3000 a day. What the service doesn't do is help the average person figure out what he or she needs to do.

On the consulting firm's web site, it's identity theft article mentions "identity management" for instance. "Identity management" usually refers to how a big company manages its (employee) user ID in a safe, secure, organized and unified fashion. "Identity management" doesn't deal directly with the accepted household term "identity theft." This confuses the matter.

Sure. Big companies need to fix its security to prevent breaches that expose personal info to possible identity theft. But to distort "identity management" and "risk management" consulting services for big companies as solutions to everyday identity theft does a disservice to the public.

My point is this: Here's a case of big business exploiting identity theft awareness by using an alarming household term to send a sales message to other big businesses - not to ordinary folks. Beware of the motive that lies beneath the message when you're looking for info to protect yourself from identity theft.

Friday, March 10, 2006

What Is Identity Theft?

What Is Identity Theft? It's the unauthorized use of someone else's personal info or identification to gain something of value. Impersonation. Fraud.

The key difference between the personal info and identification "identity theft" is this...Personal info can't be stolen.

You don't lose info like your name, home address, phone number, employment history etc. when someone else takes it and uses it.

Physical identification (i.e. driver license, passport, etc.) can be taken away from you on the other hand.

The theft generally happens when someone uses your personal info or ID dishonestly.