Gadget Wisdom - Security

It has come to our attention that people might be confused about the category based subscription. If you are subscribed to all posts on Gadget Wisdom, the feed is www.gadgetwisdom.com/feed and will display as Gadget Wisdom.

If you subscribed to one of the sections, ie Android.gadgetwisdom.com, you will only get Android themed posts. If this is your intention, please continue to subscribe in this manner. Otherwise, please change over. For convenience, ever page now shows an All Posts subscription option.

For a complete list of feeds, please visit: http://www.gadgetwisdom.com/subscribe/

Crunchgear reports today that researchers have developed an attack against WPA Encryption when using the TKIP protocol.

If you haven’t already, change your wireless access point security settings to the AES Protocol, or switch to WPA2 to stay one step ahead of them. Or, if you are out and about, and cannot do so, consider using SSH Tunneling or  VPN to encrypt your connection a second time.

Related articles by Zemanta

• New attack cracks common Wi-Fi encryption in a minute (infoworld.com)
• WiFi For Dummies: 9 Common Mistakes Setting Up a Wireless Network (makeuseof.com)

Image via Wikipedia

Early on, wireless networks were encrypted using WEP encryption, until it was discovered even the FBI could crack that in a minute.

Then came WPA, which was supposedly much more secure. However, researchers have figured out a way to break the TKIP key in about 12 to 15 minutes. Experts had known that a brute force dictionary attack could eventually break such a key, however, it was not efficient.

Researchers discovered a way to trick a router into sending them larger amounts of data. More data allows them to break the key much more easily using new mathematical techniques. The technique has already been incorporated into popular Wireless sniffer program Aircrack-ng. The newer WPA2 is considered safe from this attack.

That is the simplest way to increase security. If your router has a WPA2 capability, update to it from WPA. If it doesn’t, check to see if there is an upgraded firmware, or consider switching to a custom firmware if one is available to you that may have it. We like DD-WRT, which has ports for many routers(List of supported devices). When you set WPA2, switch from TKIP encryption to AES only. It hasn’t yet been cracked.

WPA and WPA2 for home use use a passphrase to access the network. Recommendations are that this passphrase be at least 13 characters and not consist of any dictionary word. Too many people, both in securing their networks and other passwords, use weak passwords. Remember, you don’t have to remember the thing. Your computer can do that. You can keep it in a secure file, or a password vault such as KeePass.

Do not set your wireless SSID to anything commonly used. A list of the top 1000 most commonly used ones can be found here. Top ones to avoid: linksys, default, NETGEAR, Belkin54g, Wireless, hpsetup, WLAN, Actiontec, smc, Dlink…All of these give unnecessary information about what type of router you have, as many of these are default ssids. It also tells a malicious individual you may be vulnerable.

There is also MAC filtering, which is touted as a security measure as well. A MAC address is unique to a specific piece of hardware. But since they can be spoofed, this is more of a deterrent than anything else.

Other useful features include AP Isolation. This is a feature available on many routers that disables connections from the wireless device to any devices on the network. It would ensure that a wireless computer could access only the internet, not the internal network. However, if you want to access your internal network, this is not as useful.

If you want to go to Enterprise-level WPA2, you can certainly do so. But it is usually overly complex for a simple home installation and requires an external RADIUS server, which you would have to run. If you have an always-on computer around, this might be an option.

As a final measure, you can always just give up. Bruce Schneier, security guru, runs an open wireless network, and outlines his reasons why, and links to much commentary on the subject in this post. The question of whether or not one should have open wireless is a different one than security. We will say that you can always run a secure network independently of your insecure one, and run security independently of your wireless, or if you are technically proficient, have a gateway portal the way hotels do, that secures your connection.

For example, you can use VPN to connect to your private network for security and route all communications through it. Thus it is encrypted before it leaves your computer for the network. Many businesses use this technique for individuals accessing their files remotely.

Related articles by Zemanta

• WPA wireless encryption cracked
• Once thought safe, WPA Wi-Fi encryption is cracked
• Researchers crack WPA encryption
• Researchers find more flaws in wireless security
• Battered, but not broken: understanding the WPA crack
• Download Squad PSA: WPA encryption successfully cracked
• WPA Wi-Fi Security Gets Cracked; Your Network is No Longer Secure [Security]
• How to Protect Your Wi-Fi Network from the WPA Hack

When we originally commented on the security key to be offered by Paypal, we could not secure one. Now…the Consumerist reported that they were available and we arranged to receive one. We will report back as soon as we receive this device.

Gizmodo reported yesterday on Paypal’s new security measure. Paypal will be offering a hardware-based solution which will display a one-time use passnumber every thirty seconds, to be added to your password and username. These keychain sized devices, common for business based security protocols, are an easy and inexpensive way of ensuring security…assuming you don’t lose the device.

We wish we could get one to review. We tried to log in…and it said it was currently unavailable.

Lifehacker recently came up with its New Year’s Resolutions…things people should do but don’t for their computers.

1. Regularly back up your hard drive – We know we should…but we don’t. Admittedly, we store our data on a mirroring RAID array, but that doesn’t make us any safer if disaster comes
2. Set up a self-repairing hard drive – Schedule your computer to run repair programs regularly, including things liek defragment, drive checks, etc.
3. Clean out your hard drive – Over time your hard drive becomes full of programs and files you don’t use…get rid of them. If you aren’t using it, delete it or back it up to optical media.
4. Organize your virtual filing cabinet – Now that you’ve cleaned things up…time to organize what you have into a good and easy to work with hierarchy.
5. Keep your hard drive clean – You just did all this work…you had better work to keep it that way.
6. Encrypt your private data – Protecting your important information from prying eyes is important…especially if you have a laptop.
7. Securely Track Your Passwords – First…make sure your passwords are not easy to crack…and then secure them somehow. A password program, such as KeePass, among others, can create a secure password vault.

The New York Times reports that security researchers and hackers have already found serious flaws in Vista. So far, Vista has only been released to some corporate customers and not yet to the general public.

On December 15, a Russian programmer revealed a flaw that makes it possible increase a user’s privileges. Since Vista’s greatest improvements in security involve having users run under accounts with restricted privileges for security reasons, it is a major blow. Later, a Silicon Valley security firm discovered five additional flaws, one in Windows Internet Explorer 7.

Being that the company still has some time, hopefully it will be able to roll out an update repairing these flaws. Microsoft is counting on Vista to be a moneymaker for them. We’ve commented on its lack of significant impact…although like everyone, we’ll eventually have to give in and buy it as support for XP is eventually discontinued.

Sometimes, simple ideas are the best. Take 10minutemail.com for a temporary email address that expires in ten minutes. The best use is to receive emails for organizations that require sending you informtion by email to verify yourself, but follow up with spam.

We like the title of this article from the Mobility Guru a great deal. Backup is something we save for the last minute too often…and ultimately forget, dooming us in an emergency. It is not a matter of IF you need to back up your data, it is WHEN.

For the frugal individual, try an old hard drive. For a minimal fee, you can convert it to USB operation and use it as backup. There is also the CD/DVD option, which will definitely work for some data. For the average person remember…your media files will not change, and thus can be backed up on a few DVDs rather efficient. For frequently updated information, such as application data, a copy of your registry, and your documents, you can use the old hard drive, supplemented with regular optical disc backups to back that drive up.

We follow Bruce Schneier, a guru in the field of security of all types. Recently, he commented on the issues management has in understanding IT security. Management tends to see implementing IT security measures as a low priority. Security is a preventative measure…there is no easy way to point somewhere and show the profit made by implementing good security.

Security insures against loss. Perhaps there is a way to relate a cost-savings in insurance, but besides that, security is a drain on the bottom line, be it in a corporation or with an individual.

Individuals are the same when it comes to security. The managerial side of us has to ask the justification for spending money and time protecting against loss, while our IT side speaks of viruses, spyware, malware, and environmental disasters…

Data seems too intangible to people to see it as a valuable item, like the equipment protecting it, or jewelry which must be secured. Either way, we must force ourselves to listen to our IT people, or the IT voice in our head and protect our valuables…