trscs.com

WiFi Protected Setup (WPS) Compromised

admin — Thu, 16 Feb 2012 05:11:04 +0000

Researchers publish open-source tool for hacking WiFi Protected Setup

By Sean Gallagher | Published about a month ago

Thanks to a flaw in WiFi Protected Setup, most home and small business routers could be giving away free WiFi.

On December 27, the Department of Homeland Security’s Computer Emergency Readiness Team issued a warning about a vulnerability in wireless routers that use WiFi Protected Setup (WPS) to allow new devices to be connected to them. Within a day of the discovery, researchers at a Maryland-based computer security firm developed a tool that exploits that vulnerability, and has made a version available as open source.

WiFi Protected Setup, a standard created by the WiFi Alliance, is designed specifically for home and small business users of wireless networking to easily configure devices without having to enter a long password. Offered as an optional feature on WiFi routers from a number of manufacturers, it automates the setup of the WiFi Protected Access 2 (WPA2) authentication between the router and a wireless device. One of the standard’s methods of establishing connection that is supported by all WPS-capable routers is the use of a personal identification number, usually printed on the wireless router itself, to authenticate the device.

But as security researcher Stefan Veihbock found and reported to US-CERT, the PIN implementation is susceptible to “brute-force” attacks because of the way routers respond to bad requests, and the nature of the PIN itself. When a PIN request fails, the message sent back to the wireless device attempting to connect contains information that can help an attacker by revealing whether the first half of the PIN is correct or not—reducing the number of guesses that an attacking system would have to make. Additionally, the last number of the PIN is a checksum for the the rest of the PIN. As a result, an attacker could get the PIN within 11,000 guesses. Veihbock demonstrated the vulnerability with a proof-of-concept tool he wrote in Python, available for download from his site.

That wouldn’t be as much of a problem for security if wireless access points locked out devices after repeated bad PIN entries. But on many WPS wireless routers, there is no lockout feature. That means attackers can continue to attempt to connect at their leisure.

And unlike passwords, the PIN is something that can’t usually be changed by the router’s owner. That presents a huge security loophole for attackers—once they’ve gained the PIN, they can reconnect at will to the network, even if the administrator has changed the password or service set identifier (SSID) for the network. And on access devices that have multiple radios in them providing network connectivity for different SSIDs with different passwords, the PIN can provide access to all of the wireless networks on the router.

According to a blog post by Tactical Network Solutions’ Craig Heffner, this type of attack is one that researchers at the Columbia, Maryland based security firm have been “testing, perfecting, and using for nearly a year.” Now the company has released an open-source version of its tool, Reaver, which Heffner says is capable of cracking the PIN codes of routers and gaining access to their WPA2 passwords “in approximately 4 [to] 10 hours.” The company also is offering a commercial version of the tool that offers features like a web interface for remote command and control, the ability to pause and resume attacks, optimized attacks for different models of wireless access points, and additional support.

The routers most vulnerable to these attacks—the ones without PIN lockout features—include products from Cisco’s Linksys division, Belkin, Buffalo, Netgear, TP-Link, ZyXEL, and Technicolor. None of the vendors has issued a statement on the vulnerability, or replied to inquiries from Veihbock.

Photograph by Roland Tanglao

Malwarebytes Anti-Malware

admin — Sun, 22 Jan 2012 07:02:50 +0000

Malwarebytes Anti-Malware combines powerful new technologies designed to seek out, destroy, and prevent malware infections.

Malwarebytes Anti-Malware is an easy-to-use anti-malware application available in both a Free and PRO version. The Free version is well-known for its detection and removal capabilities, and the PRO version uses advanced protection technologies to proactively stop malware infections. Additionally, Malwarebytes offers a host of extra utilities as well as an approachable forum community to help you combat any piece of malware that exists in the wild.

What’s new in this version: v1.60 Changelog

New Features:

Malwarebytes Chameleon technology gets Malwarebytes Anti-Malware running even when blocked by infection.
Incremental updates (paid version only).
Ability to password protect key program settings. (paid version only)

Improvements:

Improved reliability and performance of the update process.
Detection and removal engine enhancements.
System tray icon now dynamically displays selected language.See all new features

Microsoft Antivirus

admin — Sun, 22 Jan 2012 06:58:37 +0000

lifehacker.com

The Best Antivirus App for Windows

Windows has more antivirus programs than we can count, but we keep coming back to Microsoft’s own offering, Security Essentials. It’s easy to use, lightweight, and does everything in the background, so you rarely need to interact with it.

Microsoft Security Essentials

Platform: Windows
Price: Free
Download Page

An extremely easy to use interface from which you can manually update definitions, see your recently detected items, and schedule scans
Set the default action for different alert levels (i.e. remove or quarantine the offending file)
Real-time protection that scans all your downloads, monitors file activity, and more.
Exclude certain file types, locations, and processes from a scan
An heuristic scanning engine that helps it detect viruses not in its definitions

Microsoft Security Essentials solves every problem you’ve ever had with antivirus. It’s super lightweight, easy to use, and will update and scan without you ever knowing it was there. Its interface is dead simple to use, so you can set up schedules and change your settings when you want, but you really don’t need to do much. Set it up, forget it, and stay protected. It’s amazing it took antivirus apps this long to get this simple.

MSE’s only real downside is that it while it’s pretty darn effective, it isn’t the most effective program at catching viruses, at least according to AV-Comparatives’ report. Still, it’s one of the most effective programs out there, especially among free programs, and coupled with a bit of common sense, should keep you more than protected from any malware floating around the net. It also doesn’t have any email, IM, or other extra scanners, but we personally consider a lot of those things bloatware. There’s a fine line between feature-filled protection and something that’s just going to slow your system down more than a virus would. Practice safe browsing and emailing and you’ll get the best of both worlds.

When it comes to free options, Avira is probably the best competitor to Security Essentials. AV-Comparatives found it to be the most effective free program out there, at least with heuristics set to “high” (which isn’t without downsides, mainly a higher possibility of false positives). Like Security Essentials, it isn’t super feature-filled, and it isn’t nearly as lightweight as Security Essentials either (nor is the interface as easy to use). If you prefer something a tad less aggressive, ESET NOD32 is a great application that’s almost as simple as Security Essentials, though not quite. All three of these are great options for free antivirus.

We’d be remiss not to mention Avast and AVG, two longtime favorites of our readers. However, both have quirks that make it hard for us to recommend them over the above options—they aren’t quite as effective in finding viruses and malware, and both have their own bloat and annoyances (like Avast’s once-a-year registration requirement) that put them at the bottom of our list.

Some paid alternatives, like F-Secure, Norton, and McAfee Total Protection are better at finding viruses and malware than free options, but they do so at the cost of your system resources (and your wallet). We personally don’t think they’re necessary in a home setting, as long as you use good browsing habits, but if you want to protect yourself against every possible virus or theoretical piece of malware you could get, they might be the way to go.

In the end, the best possible antivirus you can have is good browsing practices (you know, in case I haven’t mentioned that enough). They’re more effective than any antivirus software out there, and they won’t put any kind of drain on your system resources, money, or stress level. Keep Windows and applications like Flash updated, stop downloading questionable files, and just practice good common sense. If you do, you’ll probably have to deal with your antivirus program very little.

There are more antivirus programs out there than we can even count, but these are probably the best out there right now. Many of you undoubtedly have your own favorites, some that we might not have even listed—so share your favorites with us (and why they’re your favorites) in the comments. If you’re interested in more comparisons between each program’s effectiveness, we highly recommend checking out AV Comparatives’ summary report from last year. It has a wealth of information for those looking to install antivirus on their system.