Flash and cookies - learn more about privacy

People rightly see cookies as a problem in terms of privacy and tracking their activities. If you read this article (link), you will learn about the ability of tracking cookies set by Flash, something that is used by a large number of sites.
Unlike traditional browser cookies, Flash cookies are relatively unknown to web users, and they are not controlled through the cookie privacy controls in a browser. That means even if a user thinks they have cleared their computer of tracking objects, they most likely have not.
Several services even use the surreptitious data storage to reinstate traditional cookies that a user deleted, which is called ‘re-spawning’ in homage to video games where zombies come back to life even after being “killed,” the report found. So even if a user gets rid of a website’s tracking cookie, that cookie’s unique ID will be assigned back to a new cookie again using the Flash data as the “backup.”

BetterPrivacy

A FireFox plugin for protecting your privacy.
Learn more at this link.
Ever wondered why you are still tracked though you tried everything to prevent it?
BetterPrivacy is a safeguard which protects from usually not deletable LSO's on Google, YouTube, Ebay...
Better Privacy serves to protect against not deletable longterm cookies, a new generation of 'Super-Cookie', which silently conquered the internet. This new cookie generation offers unlimited user tracking to industry and market research. Concerning privacy Flash- and DOM Storage objects are most critical.
This addon was made to make users aware of those hidden, never expiring objects and to offer an easy way to get rid of them - since browsers are unable to do that for you.

Upgrade your Wordpress blog frequently to keep it more secure

There are a large number of people who want to start blogging, don't like using a shared platform such as Blogger, and install a Wordpress blog on a shared hosting service. And once installed, they start adding new content, generating more user visits. However, a huge percentage of these people do not upgrade to the latest Wordpress version, with many of them having versions of Wordpress that is many versions old. It does not even occur to many of them that is infact a security risk. A security risk ? How come ? One would think that maybe you can lose out on a few new features by not upgrading, but how would this be a security risk ?
Well, not upgrading your version of Wordpress is like not installing the periodic security patches that come with Microsoft Windows. These security patches are meant to close holes that have been discovered in Windows, and not installing them means that you stand to risk somebody being able to hack into your system. Similarly, Wordpress is an evolving software, with holes being discovered, and the Wordpress community patching these holes through more recent versions. Consider the following page (link)

Right now there is a worm making its way around old, unpatched versions of WordPress. This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts.
2.8.4, the current version of WordPress, is immune to this worm. (So was the release before this one.) If you’ve been thinking about upgrading but haven’t gotten around to it yet, now would be a really good time. If you’ve already upgraded your blogs, maybe check out the blogs of your friends or that you read and see if they need any help.

The above example is a live example of why you would want your Wordpress installation to be upgraded to the latest available version. Who wants to be in a position where you have to fix your blog after you find that the worm caused lots of problems ?

Ad: Click Here to learn about Two Powerful & Profitable WordPress Plugins!

WordPress for Business Bloggers: Promote and grow your WordPress blog with advanced plug-ins, analytics, advertising, and SEO (Paperback)

Wordpress Hack Block: Login Lockdown

What does somebody do when they try to figure out your password for Wordpress account ? They try multiple attempts at your password, and Wordpress allows an atacker to make multiple attempts. Would it not help you if you could get a report whenever somebody makes multiple attempts to access your login account. Here is one Wordpress Plugin that helps you in this effort. The plugin is proactive in these security measures, since it directly blocks access from an IP range if there are a number of invalid login attempts from that range.
Page to read more and download (link here)

Login LockDown records the IP address and timestamp of every failed WordPress login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery. Currently the plugin defaults to a 1 hour lock out of an IP block after 3 failed login attempts within 5 minutes. This can be modified via the Options panel. Administrators can release locked out IP ranges manually from the panel.

Overview Of The Application Layer

Computer networks are inherently insecure. To keep information secret, it must be encrypted. Encryption protocols fall into two general classes: secret key (e.g. DES, IDEA), and public key (e.g. RSA). Using these protocols is straight-forward; the hard part is key management.
In addition to providing secrecy, cryptographic protocols can also provide authentication. Finally, cryptography can also be used to allow messages to be signed in such a way that the sender cannot repudiate them after they have been sent. Naming in the Internet uses a distributed database system, DNS. Domain Name Server(DNS) holds records with IP addresses, mail exchanges, and other information. By querying a DNS server, a process can map an Internet domain name onto the IP address used to communicate with that domain.
As networks grow larger, they become harder to manage. For this reason, special network management systems and protocols have been devised, the most popular of which is SNMP. This protocol allows managers to communicate with agents inside devices to read out their status and issue commands to them.
Four major network applications are electronic mail, USENET news, the World Wide Web, and multimedia. Most email systems use the mail system defined in RFCs 821 and 822. Messages sent in this system use system ASCII headers to define message properties. These messages are sent using SMTP. Two systems for securing email exist, PGP and PEM.
USENET news consists of thousands of newsgroups on all manner of topics. People can join newsgroups locally, and can then post messages all over the world using the NNTP protocol, which has some resemblance to SMTP.
The World Wide Web is a system for linking up hypertext documents. Each document is a page written in HTML, possible with hyperlinks to other documents. A browser can display a document by establishing a TCP connection to its server, asking for the document, and then closing the connection. When a hyperlink is selected by the user, that document can also be fetched in the same way. In this manner, documents all over the world are linked together in a giant web.
Multimedia is the rising star in the networking firmament. It allows audio and video to be digitized and transported electronically for display. Most multimedia projects use the MPEG standards and transmit the data over ATM connections.

Article on security for home computers

Most people who have a computer at home have no idea about what constitutes a good security policy, or what they need to do to make sure that their computers are not remotely taken over by hackers. So, here is a good article that talks about all this:

I've come up with a list of steps that, if followed, would contribute an immense amount to the security of most user's computers. I'd like all my readers to print it out and walk through it with their family, friends, churches, and clubs. Fill it in with them, or better yet, explain to them how to fill it in. If they need to know more about an item, point them back to this page and tell them to click on the links I've provided. After the checklist is filled in, tell them to post it next to their computers or in a safe place, but tell them to refer to it if they have any questions.

This is a pretty great checklist. It ensures that you have put your mind to a number of issues such as browser security, anti-virus, email, etc.

PC Tools Firewall Plus 4 for Windows

PC Tools Firewall Plus is a powerful free personal firewall for Windows® that protects your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network. By monitoring applications that connect to the network Firewall Plus can stop Trojans, backdoors, keyloggers and other malware from damaging your computer and stealing your private information.

PC Tools Firewall Plus is advanced technology designed especially for people, not just experts. Powerful prevention against attacks and known exploits is activated by default while experienced users can optionally create their own advanced packet filtering rules, including IPv6 support, to customize the network defenses. All you need to do is install it for immediate and automatic ongoing protection.

Available for download at this link.

Roadkil's Disk Wipe

Securely erases the contents of a disk replacing it with random data or leaving the drive completely blank. Numerous passes can be performed to ensure data is totally unrecoverable. Program works on hard and floppy disks aswell as USB/Flash drives.

Windows XP, Windows Vista, Windows NT, Windows 9x/Me, Windows 2000

Download from this location (link)

DiskScrub - Hard Drive Data Elimination Software

It is becoming standard practice in corporations, government agencies, law firms and accounting firms to reassign computers and to donate older computers to charity. Millions of personal computers have been put to use since 1981 when the IBM Personal Computer came into existence. Many of the older personal computers have been reassigned or donated to charity and many more will fall into this category in the future. However, data security is often ignored when computers change hands.
Personal computers were never designed with security in mind. Potentially anything that transpired on a used computer still exists. Multiply that by the number of computers your organization will reassign or surplus this year, and you get the point. Computers should be reassigned and donated to charity but the contents of the hard disk drives should not be ignored.
With computer technology changing almost daily, corporations and government agencies have to stay current while still making the best uses of aging computer resources. Advancements in hard disk drive storage capacities, operating systems and software applications cause corporations to buy or lease new computers every year. But what is done with the old computers? What is done about the sensitive data still existing, essentially "stored" on these computers when they are sold, transferred or donated? That is a serious problem, and NTI's Disk Scrub software was specifically designed to deal with these risks, for corporations, government agencies, hospitals, financial institutions, law firms and accounting firms.

Read more at this location (link)

Erase Hard Drives, Certified Data Erasure

Compliance regulations (HIPAA, Sarbanes Oxley SOX, etc.) mandate the secure erasure of all files and data that are subject to federal regulation. Failure to prevent unauthorized disclosure of privileged information can result in serious civil and criminal liability.
CyberScrub provides a wide array of hard drive erasure solutions. These products use erase methods that meet and exceed requirements set by the US Department of Defense (US DoD 5220.22) to ensure total data destruction.
cyberCide is designed for full disk sanitization, and may be deployed locally or over the network. Detailed log files, providing hard drive serial numbers, dates/times of erasure, erase method used, technician, bad sectors and other data is generated to be parsed into your compliance, audit and inventory reports. CyberCide may be run from command-lines and modified per your specifications as applicable.

Read more and download from the site (link)

Microsoft Baseline Security Analyzer 2.1

Microsoft Baseline Security Analyzer (MBSA) is an easy-to-use tool that helps small and medium businesses determine their security state in accordance with Microsoft security recommendations and offers specific remediation guidance. Improve your security management process by using MBSA to detect common security misconfigurations and missing security updates on your computer systems. Built on the Windows Update Agent and Microsoft Update infrastructure, MBSA ensures consistency with other Microsoft management products including Microsoft Update (MU), Windows Server Update Services (WSUS), Systems Management Server (SMS), System Center Configuration Manager (SCCM) 2007, and Small Business Server (SBS). Used by many leading third party security vendors and security auditors, MBSA on average scans over 3 million computers each week.

Available from this page.

AVG Anti-Virus Free Edition 8.0

Basic antivirus and antispyware protection for Windows available to download for free. Limited features, no support, for private and non-commercial use only.

Features:
* Virus and spyware protection
* Safe web surfing, downloading and instant messaging (not available with AVG Free)
* Hacker attacks prevention (not available with AVG Free)
* Phishing and E-Mail scam blocking (not available with AVG Free)
* Free AVG 24x7 technical support (not available with AVG Free)
* Stops threats before they become a problem

Download from this location.

MessenPass v1.18 - Recover Lost Instant Messenger Passwords

MessenPass is a password recovery tool that reveals the passwords of the following instant messenger applications:

* MSN Messenger
* Windows Messenger (In Windows XP)
* Windows Live Messenger (In Windows XP And Vista)
* Yahoo Messenger (Versions 5.x and 6.x)
* Google Talk
* ICQ Lite 4.x/5.x/2003
* AOL Instant Messenger v4.6 or below, AIM 6.x, and AIM Pro.
* Trillian
* Miranda
* GAIM/Pidgin
* MySpace IM

Read more and download from this location.

Mailwasher spam filter

MailWasher, is the leader in spam filter software, and the easiest way to check and manage your e-mails before you download them.
MailWasher is free to use and won't ever expire.
No gimmicks here, it is so easy to set up and use that you'll be managing your email like a pro in seconds. It can even be used as an effective privacy tool.
- Delete unwanted e-mails before you download to your computer. You’ll be able to see who the email is from, the subject, and the attachment.
- Preview. Easily preview the message in your email to see what the sender has to say before downloading it to your computer.
- Anti spam tools. Comprehensive anti spam tools ranging from your personal friends list and blacklist, customizable filters, external blacklists, bayesian spam filtering which quickly learns to distinguish your spam and good email and email virus filtering.
- Recycle bin. If you accidentally delete an email, you can restore it back to your email account.

Available at this link.

Encrypt Your Sensitive Data with this Open Source Software - TrueCrypt 5.0

Protect your sensitive data with this free open-source disk encryption software. Creates a virtual encrypted disk within a file and mount it as a real disk. Encrypt an entire hard disk partition or a device, such as USB flash drive. Automatically and transparently encrypt in real time.

TrueCrypt provides two levels of plausible deniability, in case an adversary forces you to reveal the password: a hidden volume (steganography- more information may be found here); no TrueCrypt volume can be identified (volumes cannot be distinguished from random data). TrueCrypt uses encryption algorithms AES-256, Blowfish (448-bit key), CAST5, Serpent, Triple DES, and Twofish. It is based on Encryption for the Masses (E4M) 2.02a, conceived in 1997.

In version 5.0 TrueCrypt now offers the ability to encrypt a system partition/drive (i.e. a partition/drive where Windows is installed) with pre-boot authentication (anyone who wants to gain access and use the system, read and write files, etc., needs to enter the correct password each time before the system starts).

Read more at this link.

Creating strong passwords

There is an article on Microsoft.com that describes how to create strong passwords. It's a fairly useful article, good to read and implement:
What makes a strong password ?
Make it lengthy
Combine letters, numbers, and symbols
Use words and phrases that are easy for you to remember, but difficult for others to guess
Test your new password with Password Checker
Read the whole article for much more information

SUPERAntiSpyware - AntiSpyware scanner

With a free Home User version available.

Features:
Quick, Complete and Custom Scanning of Hard Drives, Removable Drives, Memory, Registry, Individual Folders and More! Includes Trusting Items and Excluding Folders for complete customization of scanning!

Detect and Remove Spyware, Adware, Malware, Trojans, Dialers, Worms, KeyLoggers, HiJackers, Parasites, Rootkits and many other types of threats.

Light on System Resources and won't slow down your computer like many other anti-spyware products. Won't conflict with your existing anti-spyware or anti-virus solution!

Repair broken Internet Connections, Desktops, Registry Editing and more with our unique Repair System!

Multi-Dimensional Scanning detects existing threats as well as threats of the future by analyzing threat characteristics in addition to code patterns.

First Chance Prevention examines over 50 critical points of your system each time your system starts up and shuts down to eliminate threats before they have a chance to infect and infiltrate your system.

Process Interrogation Technology allows threats to be detected no matter where they are hiding on your system.

Available at this link.

Free disk space & protect your privacy

CleanUp! is a powerful and easy-to-use application that removes temporary files created while surfing the web, empties the Recycle Bin, deletes files from your temporary folders and more.

CleanUp! frees disk space and reduces the "clutter" on your computer helping it to run more efficiently. It also can be used as a way to protect your privacy on the Internet. You can even instruct CleanUp! to securely delete files making it impossible to retrieve their contents using lower-level disk tools - just another way of protecting your privacy.

CleanUp! deletes traces of you Internet activity that get stored on your hard disk. These things include:

* Browser cache
* Browser History
* Cookies
* Bookmarks and Favorites. Deletion of these is optional and disabled by default.

CleanUp! provides full support for the three most popular browsers used under Windows: Internet Explorer (versions 1.x-6.x), Netscape Navigator/Communicator (versions 1.x-7.x), Mozilla (1.x), Firefox (1.x) and Opera (versions 2.x-7.x).

Find more details and the download over here.

IBM BIOS password bypass

Passwords
As many as three passwords may be needed for any ThinkPad computer: the power-on password (POP), the hard-disk password (HDP), and the supervisor password (SVP).
If any of these passwords has been set, a prompt for it appears on the screen whenever the computer is turned on. The computer does not start until the password is
entered.
Exception: If only an SVP is installed, the password prompt does not appear when the operating system is booted.

Power-on password:
A power-on password (POP) protects the system from being powered on by an unauthorized person. The password must be entered before an operating system can
be booted.

Hard-disk password:
There are two hard-disk passwords (HDPs):
1. User HDP--for the user
2. Master HDP--for the system administrator, who can use it to get access to the hard disk even if the user has changed the user HDP
Note: There are two modes for the HDP: User only and Master + User. The Master + User mode requires two HDPs; the system administrator enters both in the same operation. The system administrator then provides the user HDP to the system user.
Attention: If the user HDP has been forgotten, check whether a master HDP has been set. If it has, it can be used for access to the hard-disk drive. If no master HDP is
available, IBM does not provide any services to reset either the user or the master HDP, or to recover data from the hard-disk drive. The hard-disk drive can be replaced
for a scheduled fee.

Supervisor password:
A supervisor password (SVP) protects the system information stored in the IBM BIOS Setup Utility. The SVP must be entered in order to get access to the IBM BIOS
Setup Utility and make changes to system configuration settings.
Attention: If the SVP has been forgotten and cannot be made available to the servicer, there is no service procedure to reset the password. The system board must
be replaced for a scheduled fee.

How to remove the power-on password
To remove a POP that you have forgotten, do the following:
(A) If no SVP has been set:
1. Turn off the computer.
2. Remove the battery pack.
3. Remove the backup battery.
4. Turn on the computer and wait until the POST ends.
After the POST ends, the password prompt does not appear. The POP has been removed.
5. Reinstall the backup battery and the battery pack.
(B) If an SVP has been set and is known by the servicer:
1. Turn on the computer by pressing and holding F1.
2. Enter the SVP. The IBM BIOS Setup Utility menu appears.
3. Select Security, using the cursor keys to move down the menu.
4. Select Password.
5. Select Power-On Password.
6. At the Enter Current Password field, enter the SVP.
7. When the Enter New Password field opens, leave it blank and press Enter twice.
8. In the Changes have been saved window, press Enter.
9. Press F10; then, in the Setup confirmation window, select Yes .

How to remove the hard-disk password
Attention: If User only mode is selected and the user HDP has been forgotten and cannot be made available to the servicer, IBM does not provide any services to reset
the user HDPs or to recover data from the hard-disk drive. The hard-disk drive can be replaced for a scheduled fee.
To remove a user HDP that has been forgotten, when the SVP and the master HDP are known, do the following:
1. Power on the computer by pressing and holding F1.
2. Enter the SVP. The IBM BIOS Setup Utility menu appears.
3. Select Security, using the cursor keys to move down the menu.
4. Select Password.
5. Select Hard-disk x password, where x is the letter of the hard-disk drive. A pop-up window opens.
6. Select Master HDP.
7. Enter the master HDP; then leave the New Password field blank and press Enter twice.
8. Press F10.
9. Select Yes in the Setup Configuration window.
Both user HDP and master HDP will have been removed.

Recover from forgotten NT Admin password

if you have forgotten your NT admin password, things could get problematic. But there is a solution. Here is a software that will allow you to reset the password of a user account on your Windows machine.

Features:

* This is a utility to (re)set the password of any user that has a valid (local) account on your NT system.
* You do not need to know the old password to set a new one.
* It works offline, that is, you have to shutdown your computer and boot off a floppydisk or CD.
* Will detect and offer to unlock locked or disabled out user accounts!
* It is also an almost fully functional registry editor!

Get it from this link.