Wireless network security

Wireless-network security isn't a single issue. Businesses need to recognize that they are fighting attacks on several fronts. Many wireless-network threats are unique to the technology, including:
Threats:
Roaming Attackers: Attackers don't have to be physically located on a business's premises in order to access data on its wireless network. Criminals use network scanners, such as NetStumbler, with a laptop or other portable device to sniff out wireless networks from a moving vehicle — an activity called "wardriving." Performing the same task while walking down a street or through a business site is called "warwalking."
Rogue Access Points: A rouge access point is one that exists without the permission or knowledge of the wireless network's owner. Employees often install rogue access points to create hidden wireless networks that circumvent the installed security measures. Such stealth networks, while fundamentally innocuous, can create an unprotected gateway that serves as an open door to intruders.
The Evil Twin: Sometimes referred to as WiPhishing, an evil twin is a rogue access point that hides under a nearby network's name. The Evil Twin waits for an unsuspecting user to sign into the wrong access point and then steals the individual's network data or attacks the computer.
Network Resource Theft: Cheapskates like to get free Internet access from nearby wireless networks. Even if these individuals intend no direct harm, they still hijack network bandwidth to surf the Web and perform other online activities, draining network performance. More nefarious freeloaders will exploit the connection to send email from a company's domain or to download pirated content — exposing the host business to legal action.
Protection Methods
With wireless providing so many opportunities for attackers to enter and harm networks and business systems, it's no surprise that a wide array of security tools and techniques have arrived to help businesses secure their networks. Here are the top protection methods:
Firewalls: A strong network firewall can effectively block intruders trying to enter a business's network via a wireless device.
Security Standards: The first wireless-network security standard — WEP (Wired Equivalent Privacy) — was highly insecure and easily compromised. Newer specifications, such as WPA (Wifi Protected Access), WPA2 and IEEE 802.11i are much stronger security tools. Businesses with wireless networks should take full advantage of a least one of these technologies.
Encryption and Authentication: WPA, WPA2 and IEEE 802.11i supply built-in advanced encryption and authentication technologies. WPA2 and 802.11i both support AES (Advanced Encryption Standard), the specification used by many U.S. government agencies.
Vulnerability Scanning: Many attackers use network scanners that actively send messages to probe nearby access points for information, such as SSID (service set identifier) and MAC (machine access code) names and numbers. Businesses can use this same approach to uncover attacker-exploitable weaknesses in their wireless network, such as unsecured access points.
Lower the Power: Some wireless routers and access points allow users to lower the transmitter's power, reducing the device's coverage range. This is a useful way of limiting access to on-site users. Careful antenna positioning and placement can also help keep signals from "bleeding" into off-site locations.
Education: All employees should be trained in the proper use of wireless devices and instructed to report any unusual or suspicious activities they detect.
taken from:-http://www.itsecurity.com/features/essential-guide-wireless-security-071708/

Read More

Flame virus warning

Microsoft issues Flame virus warning
Microsoft warned that a bug in Windows allowed PCs across the Middle East to become infected with the Flame virus and released a software fix to fight the espionage tool that surfaced last week.
Security experts said they were both surprised and impressed by the approach that the attackers had used, which was to disguise Flame as a legitimate program built by Microsoft. Kaspersky Lab, one of the researchers who helped to discover the Flame virus.
The creators of the virus obtained that certificate by manipulating a component of the Windows operating system known as terminal services licensing, or TS licensing, that is designed to authorize business customers to use advanced features of Windows. 
A bug in TS licensing allowed the hackers to use it to create fake certificates that identified Flame as being from Microsoft, Mike Reavey, a senior director with Microsoft's Security Response Center, said in a blog post. 
He feared that other hackers might be able to copy the technique to launch more widespread attacks with other types of viruses, Reavey said. 
"We continue to investigate this issue and will take any appropriate actions to help protect customers," Reavey said in the blog post. 
News of the Flame virus, which surfaced a week ago, generated headlines around the world as researchers said that technical evidence suggests it was built on behalf of the same nation or nations that commissioned the Stuxnet worm that attacked Iran's nuclear program in 2010. Researchers are still gathering information about the virus. 
Microsoft's warning is available at blogs.technet.com/b/msrc/

Read More

Virus Security

 To keep secure computer and personal data we have to know how virus can affect  ours computer as well as how antivirus work to save our PC.
An anti-virus software program is a computer program that can be used to scan files to identify and eliminate computer viruses and other malicious software (malware).Anti-virus software typically uses two different techniques to accomplish this:
Examining files to look for known viruses by means of a virus dictionary
Identifying suspicious behavior from any computer program which might indicate infection
Most commercial anti-virus software uses both of these approaches, with an emphasis on the virus dictionary approach.
Virus dictionary approachIn the virus dictionary approach, when the anti-virus software examines a file, it refers to a dictionary of known viruses that have been identified by the author of the anti-virus software. If a piece of code in the file matches any virus identified in the dictionary, then the anti-virus software can then either delete the file, quarantine it so that the file is inaccessible to other programs and its virus is unable to spread, or attempt to repair the file by removing the virus itself from the file.
To be successful in the medium and long term, the virus dictionary approach requires periodic online downloads of updated virus dictionary entries. As new viruses are identified "in the wild", civically minded and technically inclined users can send their infected files to the authors of anti-virus software, who then include information about the new viruses in their dictionaries.
Dictionary-based anti-virus software typically examines files when the computer's operating system creates, opens, and closes them; and when the files are e-mailed. In this way, a known virus can be detected immediately upon receipt. The software can also typically be scheduled to examine all files on the user's hard disk on a regular basis.
Although the dictionary approach is considered effective, virus authors have tried to stay a step ahead of such software by writing "polymorphic viruses", which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match the virus's signature in the dictionary.
Suspicious behavior approachThe suspicious behavior approach, by contrast, doesn't attempt to identify known viruses, but instead monitors the behavior of all programs. If one program tries to write data to an executable program, for example, this is flagged as suspicious behavior and the user is alerted to this, and asked what to do.
Unlike the dictionary approach, the suspicious behavior approach therefore provides protection against brand-new viruses that do not yet exist in any virus dictionaries. However, it also sounds a large number of false positives, and users probably become desensitized to all the warnings. If the user clicks "Accept" on every such warning, then the anti-virus software is obviously useless to that user. This problem has especially been made worse over the past 7 years, since many more nonmalicious program designs chose to modify other .exes without regards to this false positive issue. Thus, most modern anti virus software uses this technique less and less.
Other ways to detect virusesSome antivirus-software will try to emulate the beginning of the code of each new executable that is being executed before transferring control to the executable. If the program seems to be using self-modifying code or otherwise appears as a virus (it immeadeatly tries to find other executables), one could assume that the executable has been infected with a virus. However, this method results in a lot of false positives.
Yet another detection method is using a sandbox. A sandbox emulates the operating system and runs the executable in this simulation. After the program has terminated, the sandbox is analysed for changes which might indicate a virus. Because of performance issues this type of detection is normally only performed during on-demand scans.
Issues of concernMacro viruses, arguably the most destructive and widespread computer viruses, could be prevented far more inexpensively and effectively, and without the need of all users to buy anti-virus software, if Microsoft would fix security flaws in Microsoft Outlook and Microsoft Office related to the execution of downloaded code and to the ability of document macros to spread and wreak havoc.
User education is as important as anti-virus software; simply training users in safe computing practices, such as not downloading and executing unknown programs from the Internet, would slow the spread of viruses, without the need of anti-virus software.

Read More

Removing Security Shield Virus

Removing Security Shield can be accomplished. You must use our custom made free program called nuke-M to disable the virus. After disabling the virus you need to run PC Tools to scan and fully remove the infection from your computer. Security Shield makes several registry modifications as well as system file modifications. PC Tools will fix all of the issues that the Security Shield virus has caused.
The instructions below are the fastest and easiest way to remove the Security Shield Virus.


Begin Virus Removal by Following the Instructions Below
Target Virus: Security Shield Virus
The removal process we are illustrating below has been proven to be the most effective way to remove the Security Shield Virus.
You must be on the infected computer when performing these steps.
1.On your keyboard, click and hold the Windows key, then press the R key. See keyboard diagram below.
2.After you have clicked the Window key and R key, the Run Box will appear. Type the following into the run box and click OK:
                                   iexplorehttp://www.spywarehelpcenter.com/nuke
After you click OK, your computer will connect to our website and download nuke-M.
3.After you have saved the nuke-M file to your desktop, go ahead and run the nuke-M file by double clicking on it. If you computer asks if you are sure you want to run nuke-M, click OK. nuke-M will quickly disable the virus allowing you to install antivirus software. The virus should now be temporarily disabled. If the nuke-M file is blocked by the virus, rename the file to ‘iexplore’ or ‘explorer’ and try to open nuke-M again.
4.Now that the virus is not running it is time to begin removal. On your keyboard, click and hold the Windows key, then press the R key. See keyboard diagram below.
5.After you have pressed the Windows and R key, the Windows Run Box will open.Type the following into the run box and click OK:
                                          iexplore http://www.spywarehelpcenter.com/remove
After clicking OK, your computer will connect to our website and download our recommended virus removal program called Spyware Doctor by PC Tools. When the download box appears click the Save button.
6.Open the PC Tools installation file from your desktop and perform the virus scan.
7.Once the virus scan is complete, PC Tools will have found Security Shield. Remove the Security Shield Virus by registering PC Tools. You must register PC Tools to remove Security Shield.
8.After you have registered PC Tools the Security Shield Virus should be completely gone.

Read More

Security Shield Virus

 It is program or software which is used to steal money from your computer.Almost all type of operating system has infected from from security shield virus.There is some way or set of rule to remove this virus from computer.To uninstall this software from computer we must know which type of file can infect from security shield virus as well as we must know what type of alert it will show

                             Security Shield infects your computer through the downloading of an infected file. The commonly named infected file for this particular virus is FastAntivirus2011.exe. If you have download this file, do not open or run it under any circumstances. If you run the infected file you will fall victim to the Security Shield Virus.Security Shield is specifically designed to make you believe that it is a real antivirus and security program. It will show numerous alerts, fake scans, fake scan results and more. All of the alerts and fake scans are a scare tactic. Security Shield will claim that you have numerous infections on your computer in an attempt to have you purchase it

The Security Shield Virus sole purpose is to steal your money. The entire charade of fake scans and fake infection alerts are an attempt to have you purchase the registered version of Security Shield. Please know that there is no such thing as a registered version of Security Shield. Do not enter your credit card information into the purchase display under any circumstances.

Read More