Archive for the Security Category

Apple Safari Is Secure…. NOT!

Posted in Commentary, Security with tags , , , , on March 28, 2008 by itnerd

There’s a hacking contest that’s part of CanSecWest going on right now in Vancouver BC and for the second year in a row, a Mac was the first to be hacked. Charlie Miller who is best known for hacking the iPhone, cracked a MacBook Air with nothing but OS X installed in under two minutes by having contest organizers visit a website that contained his exploit code. That code allowed him to take control of the computer and score him the MacBook Air and $10,000. That implies that the hole that he exploited is in the Safari browser, but we won’t know for a while as he has signed a NDA to allow Apple to fix the hole. Last year Shane Macaulay used a Safari hole to score himself a MacBook, so clearly Safari is not as secure as Apple thinks it is. That’s a great reason to switch to FireFox now to protect yourself in the short term (assuming that you don’t already use FireFox) until Apple fixes it. But it really shoots a hole into Apple’s claim that “Apple engineers designed Safari to be secure from day one.” (go to www.apple.com/safari and click Security on the left hand side)

Protecting Your Laptop From Theft

Posted in Products, Security with tags , , on February 25, 2008 by itnerd

Laptop thefts are on the rise, and if you have one you need to protect yourself. The question is, how do you do it? In my mind, you need to make sure that if someone steals your laptop, you can find it wherever it is (and maybe get the bad guy to boot). Also, an alarm system would be handy so that if you leave your laptop on a table in a coffee shop so that you grab another grande skinny latte, it will alert others to a theft attempt.

Two free solutions that I recommend are iAlertU for Macintosh and Laptop Alarm for PC’s. Laptop Alarm sets off an alarm to alert you any time someone tries to log off, shut down, or disconnect your power supply or USB mouse without entering your password. iAlertU goes two better by using the Sudden Motion Sensors built into the MacBook and MacBook Pro to set off the alarm and snapping a picture of the thief and e-mailing it to you. Cool stuff.

But if you want better security than that, you’ll have to pay for it. The best thing on the street at the moment is Lojack For Laptops. Available for both Mac and PC, Lojack For Laptops is comprised of software that is installed on your computer which works behind the scenes to silently and securely contact their Monitoring Center. If the laptop is reported stolen, the software reports its location using any Internet connection. Then the software company contacts local law enforcement and works with them to recover the laptop. They promise that if they can’t recover your laptop, they will refund the purchase price of the software. It’s probably advisable to read their end user license agreement (warning, PDF link) to make sure you’re cool with that.

I personally use iAlertU myself on my MacBook Pro, but that isn’t the only thing I use. I also use a Kensington cable to secure my MacBook Pro to a solid object in a coffee shop or sometimes in my hotel room if I am traveling. Seeing as most notebook (Mac or PC) have built-in slots that accommodate these cables, it is a worthwhile investment. These cables come as key based locks or as combination based locks so you can find the solution that works best for you.

Regardless of which of these solutions that you choose, the only true method of theft prevention is never leaving your laptop alone. That’s a free method of security that’s guaranteed to work.

UPDATE: I’ve recently installed Undercover For Mac on my new MacBook Pro after my last one got taken in a break in. It will not only lead cops to the thieves who took it by phoning home and taking pictures, but it will also disable the Mac so that it forces the thieves to take it into a repair center where it (hopefully) will be returned. For $49 USD, it’s cheap insurance.

Securing Your Windows PC – FOR FREE [UPDATED]

Posted in Products, Security with tags , , , on February 22, 2008 by itnerd

I fix a lot of computers for friends as well as “friends of friends” largely because a good IT Nerd is hard to find (plus they don’t want to take it to Geek Squad). One of the things I get asked about a lot is what they should buy to secure their Windows PC and keep it virus and spyware free. First of all, it costs NOTHING to keep your PC virus and spyware free. All you need are the right products:

  • In terms of virus protection, I recommend AVG. I’ve had situation where people have installed it in place of a commercial package and had it find viruses that those packages have missed. Oh yeah, it doesn’t slow your PC down at all. Highly Recommended.
  • In terms of software based firewalls, the Windows firewall is adequate. However it only deals with incoming threats. To be completely secure, you need a firewall that deals with threats that originate from your PC as well. For this purpose, I recommend Comodo Firewall as it is easy to set up and easy to manage. Best of all, it doesn’t get in the way of your day to day use of the PC unless it has to.
  • One thing you should do on a regular basis is hunt for spyware, cookies and anything else that might have somehow made it onto your Windows PC. For that purpose, I use two packages. The first is Spybot Search And Destroy and the second is Ad Aware. Both of these packages require you to run them manually (I run both once a month), but I find both to be highly effective in terms of keeping bad things off your PC.

Again, all of the products that I have mentioned are FREE. So you don’t need to spend money to keep yourself safe. Just make sure that you update them on a regular basis to ensure you’re adequately protected from the bad guys.

UPDATE: Since I wrote this article, I’ve stopped using AdAware as I find that Spybot Search and destroy is all I need.