Rescue CDs: Tips for fighting malware

http://blogs.techrepublic.com.com/security/?p=3803

Using rescue CDs to ferret out malware is a great idea, in theory at least. Getting them to actually work is another story. Don’t make the same mistakes I did.
—————————————————————————————–
Malware is sophisticated enough to manipulate the host computer’s operating system to help it hide. That’s why rescue CDs are becoming the go-to malware detection and removal technology.

What is a rescue CD

Anti-malware rescue CDs are bootable operating systems that take control of a computer’s hardware. Since the computer’s operating system is inactive, so is any installed malware. That’s where we get the upper hand; malware can’t activate any defense to avoid being detected by the anti-malware program installed on the rescue CD.
A stumbling block
Before I present the rescue CDs I reviewed, I want to point out some mistakes I made when using rescue CDs. One embarrassing mistake happened during a visit to a client. It was the wrong time for me to realize that certain versions of rescue CDs require a new .iso file to get the latest signature definitions.
After that oops, I made sure I used rescue-CD applications that can download and incorporate the latest signature files without needing to rebuild the CD.
That brings me to my next mistake. I typically don’t give much thought to whether the network connection is hard-wired or Wi-Fi. I assumed rescue CDs would be able to update using either. That’s not always true. In some cases, rescue-CD apps will not recognize the wireless network adapter.
Here they are
The following rescue-CD applications always get good reviews and do well in independent testing. And, they are all capable of updating their signature database via an Internet connection:
AVG Rescue CD
Base: Linux (77 MB)
Configured to create either a bootable CD or USB drive
Signature Update: Online update or downloaded signature file
Avira AntiVir Rescue System
Base: Linux (47 MB)
Signature Update: Downloaded signature file
BitDefender Rescue CD
Base: Linux (228 MB)
Signature Update: Online update or downloaded signature file
Dr.Web LiveCD
Base: Linux (65 MB)
Signature Update: Online update
F-Secure Rescue CD
Base: Linux (155 MB)
Signature Update: Online update or downloaded signature file.
Kaspersky Rescue CD
Base: Linux (103 MB)
Signature Update: Online update
Norton Recovery Tool
Base: Windows Vista PE (241 MB)
Signature Update: Online update
Best at detecting malware
Avira’s AntiVir Rescue System is consistently on top when it comes to malware detection. Virus Bulletin is a well-known test house for anti-malware, and they place AntiVir Rescue System first (registration is required).
A close second is BitDefender Rescue CD. To many system admins being second is not an issue. That’s because BitDefender Rescue CD has many attributes that make their job easier.
Most features

BitDefender Rescue CD outclasses the entire group when it comes to features. That’s in large part due to BitDefender using Knoppix, a well-thought-out Linux distro. It has many third-party apps such as ChkRootKit, Nessus Network Scanner, Partition Image, and GtkRecover. One additional convenient feature is the inclusion of the Firefox Web browser.

Create a rescue flash drive
Most rescue CD applications require converting an .iso file to make a bootable CD. If that seems confusing, this link to the Petri Web site will help explain. With netbooks becoming popular, using a rescue CD isn’t an option. One way to resolve that is to use UNetbootin. It is an application that will create a bootable flash drive from any of the above rescue-CD .iso files. I have to admit though, it’s a cumbersome process.
Thankfully, AVG Rescue CD has an alternative answer. Simply download the rescue file specifically developed for flash drives, extract the contents of the file to the flash drive, and click on makeboot.bat. That’s it. You now have an AVG Rescue Flash Drive.
OS boot sequence
One other consideration that needs to be addressed is the boot sequence of the computer being worked on. If you are using a rescue CD, the CD drive has to be moved to the top of the list. If you are using a netbook, more than likely the USB drive will already be first on the list and not a problem.
My rescue-CD wish list
Many things have to go right for rescue CDs to work. It doesn’t have to be that way. All it would take is the following:

• Make it simple to create “rescue flash drives.” Why? They can be easily updated without involving access to the computer’s operating system or having to recreate the CD.
• Make sure the BIOS software recognizes USB drives in their boot sequences.

Final thoughts
Rescue CDs and rescue flash drives will become more important as malware writers figure out better ways to obfuscate their code. Rootkits come to mind as they are the forerunners of deception.
If you prefer a rescue-CD application not listed here, I would appreciate learning about your experience.

Get IT tips, news, and reviews delivered directly to your inbox by subscribing to TechRepublic's free newsletters.

Three common IT consultant security blunders

Three common IT consultant security blunders: "
IT consultants cannot afford to make a mistake when it comes to security. Erik Eckel offers a refresher on basic security fundamentals.

—————————————————————————————————-

Humility is an important quality in IT consultants. The industry has a way of knocking consultants down a peg and reminding professionals to mind their fundamentals when overconfidence sets in. Security, however, is an area in which consultants can’t afford lapses, especially since Sarbanes-Oxley, HIPAA, and data sensitivity have become critical issues.

When I inherit systems, servers, workstations, and networks developed and administered by others, I see other IT consultants’ mistakes. I’ve also seen security failures at the companies where I’ve worked.

Some security errors are simple brain-dead mistakes, such as affixing administrative usernames and passwords to a server via a Post-it note; other security offenses are less subtle, such as using the same password structure for each client. (Because of one competitor’s administrative password naming scheme, I can now log on to any of their clients’ systems replicating a simple password pattern.)

Of all the security failures that I’ve seen, there are three common ones that stand out. Review your consultancy’s practices to ensure clients are protected from these blunders.

1: Permitting simple passwords

I’m truly shocked at how many so-called IT professionals permit users and colleagues to set simple passwords that consist of just letters and even words found in common dictionaries. Simple passwords are easily hacked, which can lead to identity theft, unauthorized use of proprietary data, embarrassing leaks, and federal data standard violations.

In racing, when newbies complain of the cost of a good helmet, the seasoned veteran answers, “If you have a ten-dollar head, wear a ten-dollar helmet.” If a client has gone to the trouble of investing heavily in firewalls, encryption applications, and additional security parameters, they should invest in requiring complex passwords. Whether the client is protecting a router, a user account, an email address, or another system, you need to insist that employees use eight character or longer passwords that use all of the following: uppercase letters, lowercase letters, numbers, and special characters.

Sure, such passwords are inconvenient, but that’s the point. Passwords are a critical component of typically multiple-tiered security systems that are all too often negated as a result of nonchalance. If I can memorize the 26 phonetic alphabet codes, and coworkers can commit to memory the 486 tongue-twisting words to the I Am The Very Model Of A Modern Major General song from The Pirates of Penzance, users can memorize eight to 10 or more characters.

Also, be sure your passwords don’t follow the same naming patterns because that’s too simple, even if you use complex characters. For example, if one discovers that Acme’s server administrative password is Acme*123, it’s not going to be too difficult to determine that the Smith company’s administrative password is Smith*123, is it?

2: Deploying equipment using default passwords

IT consultants who deploy business-class equipment using default passwords should return whatever service fees they collect to their clients. Exhaustive lists of default passwords are a simple Google search away. This is exponentially more important when deploying routers, firewalls, and other systems that are accessible from the Internet.

As I explain to clients, your data or company doesn’t need to be all that sexy to be of interest — far from it. Hackers write robotic programs that scour the Internet for nodes that respond. Once a node responds, the device becomes a target for attack. This is true whether the device is stationed inside a plumber’s office or a bank.

When organizations need to ensure remote administration of devices is possible, your office can work to restrict authorized connections via originating IP addresses to tighten security. But whenever a security device or any node is connected to the Internet, default passwords should be changed. By using tough-to-crack passwords on equipment, you make it difficult for unauthorized users to gain access, whether those unauthorized users are bored internal employees, angry and disgruntled ex-workers, or black hat criminals.

3: Sharing passwords via unencrypted email

It never fails. Organizations invest in enterprise-class firewalls, deploy disk encrypting software, and institute multiple-tiered logins — which each require different usernames and passwords that must regularly be reset and cannot match previously used passwords — and then someone emails the keys to the kingdom via unencrypted email. Forwarding administrative passwords via unprotected email, even to authorized users or colleagues, is a practice all IT consultants should eliminate.

Email is inherently insecure. Messages pass not only through the sender’s email server but to the recipient’s server and through an inestimable number of systems in between. Each step in the chain offers the potential for unauthorized users.

I used to be more cavalier regarding security, but years of IT consulting and experiencing the myriad and shocking ways in which businesses battle competitors, disgruntled staff, and others, I place a much greater emphasis on following security fundamentals. One excellent security fundamental that will help keep systems safe is avoiding sending passwords via clear text email. Just don’t do it.

Related IT security resources on TechRepublic

• A user name is not a password
• 10 essential e-mail security measures
• Five tips for avoiding self-inflicted email security breaches
• Help consulting clients create strong password policies
• Presentation download: Raise user awareness about password security

"

Router Password Recovery

Router Password Recovery: "
The new Nirsoft application Router Pass View may help computer users in the recovery of router passwords. Many modern routers have an option to backup the configuration of the router into a file so that the settings can be restored at a later time.
These router configuration backups often contain important data like the login password of the router, the ISP username and password and wireless access configuration settings.
Router Pass View has been designed to extract the login information found in router configuration backups. The portable software program supports a limited number of routers with the promise to add additional routers in the future.

Internet Explorer History Monitor

Internet Explorer History Monitor: "

Microsoft’s Internet Explorer keeps track of the accessed websites and urls just like any other web browser by default. That’s helpful to keep track of already visited websites, especially to access them at a later time if their url cannot be remembered and they have not been added to the bookmarks of the browser.
But the Internet history has also raised privacy concerns as it can be used to trace a user’s activities on the Internet. It is possible to change the history settings in Internet Explorer and delete the history right away.
The portable program IE History Monitor offers an alternative to that by displaying the complete Internet Explorer history in its interface.

DLS (beta) review: free, portable Norton Power Eraser takes aim at malware

DLS (beta) review: free, portable Norton Power Eraser takes aim at malware: "

Tabjacking: a new and ingenious phishing attack

Tabjacking: a new and ingenious phishing attack: "
Filed under: Internet, Security, Browsers

By now, all but the most geriatric Web users know about phishing. Usually it takes the form of a seemingly-official email from a bank or other money-related Web service. Most of the time these attacks are painfully obvious -- but what if you removed the email attack vector? What if you removed those daft give-away URLs? What if the phishing attack was pure, seemingly-benign JavaScript that's invisible to all but the most judicious of Web users?



That's exactly what 'tabjacking' does. Open Aza Raskin's proof of concept in a new tab. Admire the sample code. Now, change tabs, wait five seconds, and then watch in horror as his site seemingly becomes GMail.



Malicious JavaScript injection isn't a new thing -- and this particular exploit only works in Firefox (and partially in Chrome) -- but you have to admit it's pretty damn scary. It's certainly only a matter of time until workarounds are found for the other browsers -- and the implications when combined with targeting 'hacks' such as CSS history mining are petrifying.



You wouldn't have to hack the site to inject the JavaScript either: an add-on or extension would work just as well...



If you're like me, I always check the address bar before typing a sensitive password. I'm not actually sure what I'll do, now that tabjacking code is in the wild.



As Aza says, it's high time we move to browser-based authentication solutions like the Firefox Account Manager."

Hot 6 passwords that will make any IT security pro cringe

Hot 6 passwords that will make any IT security pro cringe:

1. < password >
2. < 666666 >
3. < secret >
4. < letmein >
5. < insert expletive here >
6. < insert preferred sports team name here >

Password resources on TechRepublic:

1. Download: End-user password security
2. Help users create complex passwords that are easy to remember
3. Fight back against bad password policy
4. Securing end users’ pesky password problems
5. Helping users remember their passwords
6. Help consulting clients create strong password policies

Here are a few other links that you should check out:

• Is Apple the Most Admired Company? It depends who you ask
• TechRepublic Questions of the Week - April 5, 2010
• TR member Garden Club gallery
• TR Member pet pics
• TR Member tattoo pics
• TR Member costume pics

If you’d like to contribute to the pics galleries, please send us your photos.
Also, don’t forget to sign up for the TechRepublic Community Central newsletter!