Lock It When You Leave It

SANS Institute — Never leave your computer logged in when you walk away, not even for a minute. Make it a habit to log off your workstation whenever you get up. Remember to always leave your Windows computer by pressing the keyboard shortcut combination of the Windows logo key and the letter “L” on a Microsoft natural keyboard. Get it? Leave Windows by pressing the Windows logo + L keys together to lock it up.

Internet Safety for Children in Pennsylvania

HARRISBURG – Attorney General Tom Corbett today announced the recent arrest of six suspected Internet predators across Pennsylvania and urging parents to make online safety part of their spring and summer family discussions.

“Now, more than ever, it is important for families to discuss Internet safety, as warmer weather brings changes in school schedules and family activities,’” Corbett said. “As spring quickly gives way to summer vacation season, online predators are hoping that more teens will be home alone for longer periods of time and may be spending more time on-line chatting with their friends, playing games or just exploring the Internet.”

Corbett identified the defendants recently arrested by the Child Predator Unit as:

•Josef Graf, age 70, 133 N. Rt. 88, Charleroi, Washington County.
•Donald J. Ferrenberg, age 26, 124 State Route 271, Ligonier, Westmoreland County.
•Terry Lynn Hackenberg, age 46, 93 Park Road, Jersey Shore, Lycoming County.
•Bryan Neal McLean, age 44, 212 Sunset Ave., Hanover, York County.
•Joshua D. Baer, age 31, 319 Watson Park Blvd., Lehighton, Carbon County.
•David T. Martin, age 40, 120 Coates Ave., Elkland, Tioga County.
“We know that spring and summer trigger a jump in the number of incidents involving Internet predators,” Corbett said. “Last year, our Child Predator Unit arrested 32 people during the spring and summer months, including men from every corner of Pennsylvania and from as far away as Texas, Massachusetts, North Carolina, Maryland, New Jersey and Ohio, all trying to use the Internet to sexually victimize children.”

Corbett noted that the Attorney General’s Child Predator Unit has arrested 258 online predators since it was created in January 2005. To date, the unit has a 100% conviction rate.

Recent arrests highlight dangers
Corbett said that circumstances involved in recent arrests across the state highlight the threat posed by online predators and the many different ways they operate. In each of these recent cases, suspects communicated with undercover agents from the Child Predator Unit who were using the online profiles of 13 and 14-year old girls.

According to the criminal complaint, Josef Graf, who is 70 years old, initially identified himself as a much younger man. Graf allegedly used an Internet chat room to sexually proposition what he believed was a 13-year old girl, telling her, “I want to see you naked” and urging her to travel to Pittsburgh for sex.

David T. Martin, from Tioga County, allegedly urged a young teen to meet him for sex and told her that he wanted to sign and date her underwear on the day he took her virginity.

Donald J. Ferrenberg is charged with sending a nude webcam video during his first online conversation with what he thought was a 13-year old.

Terry Lynn Hackenberg allegedly approached what he believed was a young girl in an Internet chat room, asking her to “play” with him sexually and using a computer webcam to expose himself.

Bryan Neal McLean, a 44-year old from Hanover, is accused of sending computer webcam videos that showed him masturbating in front of his computer.

Joshua D. Baer, who went by the screen name “I love busty women 27,” allegedly sent what he called “naughty” pictures during his chats with what he believed was a 14-year old girl, including photos of his genitals.

Corbett said that all of the suspects are charged with various counts of unlawful contact with a minor and criminal use of a computer, felony charges which are punishable by up to seven years in prison and $15,000 fines.

All of the defendants will be prosecuted in the counties where they were arrested.

Ferrenberg and Graf will be prosecuted by Deputy Attorney General William F. Caye II of the Attorney General’s Child Predator Unit.

Baer, Hackenberg, Martin and McLean will be prosecuted by Deputy Attorney General Christopher Jones of the Attorney General’s Child Predator Unit.

Internet Safety
Corbett urged parents to talk regularly with kids about being safe on the Internet and to stress the importance of telling a trusted adult if someone does something inappropriate online, including:

•Sexual discussions.
•Sending explicit photos or videos.
•Sending links to pornography.
•Trying to arrange face-to-face meetings.
Additionally, Corbett said parents and other caregivers should also monitor how kids are using the Internet, including:

•Checking the websites they use frequently.
•Searching the social networking sites they visit.
•Asking them to show you their online profiles on FaceBook, MySpace and other websites and discussing the items they may be posting online.
Corbett added that parents and kids need to understand that safety concerns now extend beyond home computers.

“Many cell phones and game systems can be used to send and receive messages or photos and can also be used to access websites,” Corbett said. “The same safety rules need to be applied to all of these devices.”

Corbett said that parents should also emphasize that kids should not share personal information online, like full names, ages, addresses, phone numbers and school information, and should be especially cautious about strangers who approach them online.

Suspected internet predators can be reported to the Attorney General’s Office by clicking on the “Report a Predator” link, located on the front page of the Attorney General’s website, or by calling the toll-free Child Predator Hotline at 1-800-385-1044.

(A person charged with a crime is presumed innocent until proven guilty.)

Beware of Shoulder Surfing

A person who is standing near as you fill out a form, enter your PIN number, or punch in your calling card numbers may be doing more than just waiting their turn. To help prevent shoulder surfing, shield your paperwork from view using your body and cup your hand over the keypad.
by Nitin Dewan

Use Caution Opening Email Attachments

Email attachments are a common tool for attackers because forwarding email is so simple. Users often open attachments that appear to come from someone they know or an organization they do business with. Almost any type of file can be attached to an email message, so attackers have more freedom with the types of viruses they can send. If your email program includes an option to automatically download email attachments, DON’T take it. Doing so could immediately expose your computer to any viruses included in the email attachments.

Facebook Password Reset Confirmation! Your Support.

WARNING: beware of email that claims to be from Facebook.

The subject line usually reads like this:
Facebook Password Reset Confirmation! Your Support.

The body of the email reads:
Dear user of facebook,

Because of the measures taken to provide safety to our clients, your password has been changed.
You can find your new password in attached document.

Your Facebook.

Attachment Converted: “c:\Facebook_password_Nr63971.zip”


The attachment carries a payload of malicious software. Do NOT unzip the file.

Game Theory For Security

GameSec 2010 – Conference on Decision and Game Theory for Security 22-23 November 2010, Berlin, Germany

Industry Gold Sponsor: Deutsche Telekom Laboratories
Industry Silver Sponsor: Frauenhofer Heinrich Hertz Institute

Technical co-sponsors: IEEE Control System Society, Internatational Society of Dynamic Games

GameSec 2010, the inaugural Conference on Decision and Game Theory for Security will take place on the campus of Technical University Berlin, Germany, on November 22-23, 2010.

Securing complex and networked systems and managing associated risks become increasingly important as they play an indispensible role in modern life at the turn of the information age. Concurrently, security of ubiquitous communication, data, and computing pose novel research challenges. Security is a multi-faceted problem due to the complexity of underlying hardware, software, and network inter-dependencies as well as human and social factors. It involves decision making in multiple levels and multiple time scales, given the limited resources available to both malicious attackers and administrators defending networked systems.

GameSec conference aims to bring together researchers who aim to establish a theoretical foundation for making resource allocation decisions that balance available capabilities and perceived security risks in a principled manner. The conference focuses analytical models based on game, information, communication, optimization, decision, and control theories that are applied to diverse security topics. At the same time, the connection between theoretical models and real world security problems are emphasized to establish the important feedback loop between theory and practice. Observing the scarcity of venues for researchers who try to develop a deeper theoretical understanding of the underlying incentive and resource allocation issues in security, we believe that GameSec will fill an important void and serve as a distinguished forum of highest standards for years to come.

Topics of interest include (but are not limited to):
* Security games
* Security and risk management
* Mechanism design and incentives
* Decentralized security algorithms
* Security of networked systems
* Security of Web-based services
* Security of social networks
* Intrusion and anomaly detection
* Resource allocation for security
* Optimized response to malware
* Identity management
* Privacy and security
* Reputation and trust
* Information security and watermarking
* Physical layer security in wireless networks
* Information theoretic aspects of security
* Adversarial machine learning
* Distributed learning for security
* Cross-layer security
* Usability and security
* Human behavior and security
* Dynamic control of security systems
* Organizational aspects of risk management
* Cooperation and competition in security
* and more…

Revoking Security Access Is Not Enough

A California man has been arrested for interfering with computers at the California Independent System Operator (Cal-ISO) agency, which controls the state’s power transmission lines and runs its energy trading markets. Even though Lonnie C. Denison’s security access had been suspended at the request of his employer because of an employee dispute, he allegedly gained physical access to the facility with his card key. Once inside, Denison allegedly broke the glass protecting an emergency power cut-off station and pushed the button, causing much of the data center to shut down. Cal-ISO was unable to access the energy trading market, but the power transmission grid was unaffected.



Use a password in only one place.
Reusing passwords or using the same password all over the place is like carrying one key that unlocks your house, your car, your office, your briefcase, and your safety deposit box. If you reuse passwords for more than one computer, account, website, or other secure system, keep in mind that all of those computers, accounts, websites and secure systems will be only as secure as the least secure system on which you have used that password. Don’t enter your password on untrusted systems. One lost key could let a thief unlock all the doors. Remember: Change your passwords on a schedule to keep them fresh.

Census Campaign Warning

US-CERT asks users to be vigilant during the U.S. Census Bureau’s 2010 Census campaign and to watch for potential census scams.

According to the U.S. Census 2010 website, they began delivery of the printed census forms to every resident in the United States on March 1, 2010. The only way to complete the census is by filling in the form using pen and ink; in some instances, census takers will be visiting households to complete the form face-to-face. It is important to understand that the U.S. Census Bureau will not, under any circumstances, be providing an online option to complete the 2010 census form.

US-CERT encourages all residents in the United States to take the following measures to protect themselves:

•Review available information about the 2010 U.S. Census on the website.
•Familiarize yourself with what information the U.S. Census Bureau is collecting on the census form.

•Do not follow unsolicited web links of attachments in email messages.
•Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
•Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Understanding Your Computer: Web Browsers

Web browsers allow you to navigate the internet. There are a variety of options available, so you can choose the one that best suits your needs.

How do web browsers work?
A web browser is an application that finds and displays web pages. It coordinates communication between your computer and the web server where a particular website “lives.”

When you open your browser and type in a web address (URL) for a website, the browser submits a request to the server, or servers, that provide the content for that page. The browser then processes the code from the server (written in a language such as HTML, JavaScript, or XML) and loads any other elements (such as Flash, Java, or ActiveX) that are necessary to generate content for the page. After the browser has gathered and processed all of the components, it displays the complete, formatted web page. Every time you perform an action on the page, such as clicking buttons and following links, the browser continues the process of requesting, processing, and presenting content.

How many browsers are there?
There are many different browsers. Most users are familiar with graphical browsers, which display both text and graphics and may also display multimedia elements such as sound or video clips. However, there are also text-based browsers. The following are some well-known browsers:

•Internet Explorer
•Safari – a browser specifically designed for Macintosh computers
•Lynx – a text-based browser desirable for vision-impaired users because of the availability of special devices that read the text

How do you choose a browser?
A browser is usually included with the installation of your operating system, but you are not restricted to that choice. Some of the factors to consider when deciding which browser best suits your needs include

•compatibility – Does the browser work with your operating system?

•security – Do you feel that your browser offers you the level of security you want?

•ease of use – Are the menus and options easy to understand and use?

•functionality – Does the browser interpret web content correctly? If you need to install other plug-ins or devices to translate certain types of content, do they work?

•appeal – Do you find the interface and way the browser interprets web content visually appealing?

Can you have more than one browser installed at the same time?
If you decide to change your browser or add another one, you don’t have to uninstall the browser that’s currently on your computer—you can have more than one browser on your computer at once. However, you will be prompted to choose one as your default browser. Anytime you follow a link in an email message or document, or you double-click a shortcut to a web page on your desktop, the page will open using your default browser. You can manually open the page in another browser.

Most vendors give you the option to download their browsers directly from their websites. Make sure to verify the authenticity of the site before downloading any files. To further minimize risk, follow other good security practices, like using a firewall and keeping anti-virus software up to date (see Understanding Firewalls, Understanding Anti-Virus Software, and other US-CERT Cyber Security Tips for more information).