Dave Schaefer's Surreal Paradigm

I just heard from my wife today that my neighbor received a call from a possible computer attacker on the phone last night.

The scam is that the potential attacker cold called my neighbor (the potential victim) in order to ask her if they can clean her computer.  The problem is, my neighbor didn’t know this person, and it’s kind of strange to get a call like this from out of anywhere.  The attackers stated they were from Microsoft, and wanted to help her.  She highly doubted this claim, as she knows the likelihood of Microsoft cold calling her to clean her computer wouldn’t happen.

The problem with this is you don’t know who these people are and after you let them in to touch the computer, the attackers can impregnate it with a malicious on or multiple payloads (backdoors, worms, rootkits, oh my!).  Don’t be surprised when they use big names like Microsoft, Apple, Symantec, or any of the other house hold names in computer products that we have become accustom to hearing.   The other thing is that this attack isn’t new, and it has been used for years… however… think about it.  It must work in order to the attackers to waste their resources (time and money) on this attack if they are still calling people trying to trick them into infecting their machines!

Just like when you have someone work on your taxes, you need to be picky with selecting the computer repair person to help you with your PC.  The problem is that an attacker acting as a technician can take control of your computer and do whatever they want – if they are not trustworthy.

The computer unethical market actually gets paid for creating what are called “botnets” of thousands or millions of computers.  Buyers that want to control those botnets for malicious deeds like taking down websites can actually rent these computers out from the original people that infected them.  Thus there is actually an underground industry that promotes the infection of large amounts of PCs that this is all potentially leading back to.  They also may be data mining your PC to get account numbers, social security numbers, etc.

This isn’t the first time I heard of not so nice people out there infecting machines in person or via the phone.  They are hinging on the fact of a good ole fashion version of social engineering to gain control of your computer.

Social engineering is the manipulation of human behavior to track a victim into doing something they wouldn’t normally do.  Social engineering could be used for a majority of things from child abductions all the way over to computer crimes.  In most cases it allows the attacker to gain access to information, systems, or areas that the attacker wouldn’t normally have access to.  In this case the potential attacker was socially engineering themselves to be Microsoft, and thus banking on the fact that the person would trust Microsoft and let the attacker infect the victim’s computer.  Keep in mind that the attacker isn’t going to come out and tell you who they are… they’re going to act like someone you know and try to use tactics to win your trust.

The reason why this type of attack is so alarming is that 1) People expect computers attacks to come through the computer, not people.  This expectation of computers only attacking computers actually (2) lowers the defenses of potential victims when they receive the request via a phone (or in person) to fix the victim’s computer.  By lowering the defenses of the victim, the attacker inversely increasing the chance of the attack to succeed.  To the attacker it’s a win-win situation, often times thinking if the victim is foolish enough to fall for the attack, then they deserve it.  It’s the same reasoning that is used by mass murderers and other criminals on the web, as the attackers psychologically begin to demean victims with insults to make themselves feel better about doing bad deeds.

Please spread the word to never trust someone who cold calls you telling you they want to fix your computer, now that you know.

Keep in mind there are other stories out there where attackers infected computers in person:  such as the one pervert that took over multiple female victim’s video camera’s on their computer by infecting machines instead of cleaning them.   In that attack, the attacker displayed a message on the women’s computer to have them take their computers in moist spot to make their computers feel better (some women actually took their computer in a shower where he would record them).

The reason why I post this stuff is because I care about all of you, and I realize as a computer security professional that the only way to beat these guys is together.  The attacker’s mind never thinks about what happens to the victims…

Security starts with people first and foremost… computer or otherwise.

It doesn’t matter if you’re a computer security professional or a person who just purchased a computer for the first time – sooner or later we all have run into the hideous computer gremlins.

These gremlins can take the form of computer programs or even manifest themselves as social engineering thieves in the physical world. In the logical computer security realm we call these nasty little green monsters “malware” (short for Malicious Software).

This is an all encompassing term that includes things like spyware, computer viruses, worms, Trojan horses, rootkits as well as other unwanted software that may be on your computer.

Malware is anything but cute, as it can do all sorts of damage ranging from identity theft to making your brand new $3000 computer feel like a 2000 year old abacus (what we computer geeks often claim was the first computer).

Just like the cute, fuzzy, teddy bear creature they called a Mogwai in the 1984 hit
Gremlins, these malware threats often come in the form of a cute little program,
interesting e-mail, or link on the web intentionally made to peak your curiosity.

However, to avoid these programs and possibly ending up a victim, there are sites out
there created by reputable organizations that are focused on bettering our security
posture.

These include:

• Microsoft Online Safety website: http://www.microsoft.com/protect/default.aspx
• Cyber Security Tips by the US-CERT (United States Computer Readiness Team): http://www.us-cert.gov/cas/tips/
• National Security Alliance at: http://www.staysafeonline.org/

So, do you think you’re ready for the Gremlins?

There’s even a Self Assessment Quiz I encourage you to take at: http://www.bbc.co.uk/newsround/14979083

If you’re feeling lucky!

Good luck, and remember not to feed your computer after midnight.

Hello,

I guess I will start with a mission and vision because I may need to refer back to it from time-to-time, and hopefully it also sets the tone for this site.  First before we continue however, we need to define some terms so that we can all understand what they mean.

Information Technologies (I.T.):  Includes general technologies (but not limited to) computers and phones as it relates to computer science.  The term first appeared in the Harvard Business Review by Leavitt and Whistler in 1958 to describe new technology that does not have a single established name.  Some examples may include web technologies (like this page you’re reading), computer virtualization, knowledge base systems, cloud computing, smart phone technologies, traditional computers, and more (as stated it’s generally relating to technologies)!

Information Systems (M.I.S. and I.S.):  The interaction of computer systems and humans.  Interesting fact, during the early days of computer systems humans that worked on the systems were actually called “computers.”  Thus the term computers signifies the symbiotic relationship as is relates to computer systems, and the support for those systems.  Information Systems (I.S.), includes the fundamental support, management, and decision making that is required by people which in turn allows others to interact with technology to support business requirements.

Information Security (InfoSec): 

Describes security as it relates to Information Technologies (I.T.), and a subset to Information Assurance (IA – below).  The overall goal of InfoSec is to protect information (credit card number, passwords, social security numbers, or whatever else is important to you that you don’t want others to have) from threats (con artists (phishing), people breaking in (hackers), and malicious code (virus, worms, rootkits, oh my!).

Wikipedia will have you believe that IA and InfoSec are interchangeable but again, Wiki has failed us.   InfoSec was designed to protect computer systems, and was later expended to create a new view called Information Assurance when the government realized it wasn’t enough.    InfoSec is more computer systems focused than Information Assurance.

• Information Assurance (I.A.):  Defends information and Information Systems (I.S.) from a breach.  It protects users via a concept called the CIA Triad to protect information, which includes:

• Confidentiality - The ability to conceal the information that needs to be protected. Example:  Protecting the system from a student accessing everyone’s password on that system.

• Integrity - The ability to make sure that the information you’re protecting doesn’t get changed.

Example:  Protecting the system from a student changing his/her grade in a system when it was unauthorized.

• Availability - The ability to keep systems available during the times the information is needed.  Example:  Ensuring the heating and cooling in a computer room is sufficient so that the equipment doesn’t overheat and fail during student registration at a school.

• There are more terms that build upon the original CIA triad like non-repudiation (ability to ensure that someone can’t repute something, in other words deny it) for example.

Shared Governance – Basically is a hippy like concept I believe in, it basically means that those of us that know something about anything should help others out that are not as familiar with it.  In my case, this page represents part of my shared governance commitment to the community by allowing me to share some of my thoughts on how to properly perform computer related tasks, etc.

With that said, our world of Information Technologies (IT) is constantly evolving, and even as I write this page I’m amazed on even how some of the above terms and concepts changed or have gotten so confused to the general public.  It seems as time goes by others take and manipulate these terms to make them similar and create further confusion of the concepts, which is greatly disappointing to me.  It’s the results of an industry that is still trying to find our ways.

My Commitment to this blog is as follows:

Mission Statement:  To create and add value to my friends, family, and students by providing a shared governance commitment as it relates to computers and security in general.

Vision: Shared Governance and helpful tips as it relates to information technologies and Information Assurance through sharing things I have learned as a student, professor, and information technologies employee.

The main point of this site is to have a place to point my students, friends, and family for technical situations and solutions I’m commonly asked for as a Computer Information Systems (CIS) instructor, Information Technology (IT) worker, and a Information Assurance (Security) advocate/instructor.

I’m currently working on this site to hopefully create a place I can store my documentation and recommendations for administration and security as they relate to computers in general.  If you would like to use any of the information in this site, please contact me by posting.  Thank you!