Wednesday, December 2, 2009

Team Phishing

a. How is your talk being organized? What is the flow of your talk? Which topics will be covered in your talk and in what order?

Our presentation will be organized by topic. Each member of our group will be covering one of the three topics assigned: phishing, smishing and than pharming.

b. Who will present what? How are you dividing the material/section/answer?

Our group is presenting on phishing, smishing and pharming, so we have decided the information up by assigning each group member a specific topic to cover. All of us will engage in the Q & A section.

Phishing- Jacki Seisman

Smishing- Aaron Richards

Pharming- Jenn McHugh

c. What are your 5 best references?

http://www.webopedia.com/TERM/p/pharming.html

http://www.crime-research.org/news/07.03.2005/1015/

http://www.spamlaws.com/pharming.html

http://www.netlingo.com/word/pharming.php

http://en.wikipedia.org/wiki/Pharming

Monday, November 30, 2009

Group Security Topics Assigned

1. What is phishing, pharming, smishing, and how does it work?
Group Members: Aaron Richards, Jackie Seisman, Jenn McHugh

2. What are viruses (not including trojan horses, malware, adware, spyware, backdoors) and how do they work?
3. What are trojan horses, malware, adware, spyware, baiting, and some scenarios for how this works.
4. Outline of password cracking techniques? What are some recommendations for good password security? Discuss new password methods (picture passwords, etc), password storage software, password lengths, etc.
5. What are some common internet scams? Example: click scams, international modem dialing, paypal fraud, pump-nd-dump stock fraud, advance fee fraud. Nigerian 419, Spanish Prisoner, craigslist pay first scam. How do these scams work? How does the internet/web make this kind of fraud easier to perpetrate?
6. What is spam (not including scams like Phishing, Nigerian 419 or chain letters) and how does it work? Does anyone really buy the products advertised in spam?
7. What are some different techniques for computer surveillance? Consider both "good guy" and "bad guy" perspectives. What is the difference between a good guy and a bad guy in this case? Include packet sniffing, carnivore, keystroke loggers, radiation emanations from monitors, Room 641-A.
8. What is strong cryptography? Why would non-criminal, non-military people need access to strong cryptography? If strong cryptography is considered a "munition" or military technology, then can a web browser like Mozilla Firefox that is made in the US be downloaded by a citizen of another country? Or is the browser not really using strong crypto? If not, are your internet transactions really secure?

Phishing, Pharming and Smishing
Phishing: In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing is typically carried out by e-mail or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. http://en.wikipedia.org/wiki/Phishing

Pharming: "Pharming isn't completely new. It combines a mix of mainstream threats such as viruses and spyware, plus more esoteric stuff such as domain spoofing and DNS poisoning. In one scenario, a user receives some kind of malware (virus, worm, Trojan or spyware) that rewrites local host filesâ¬which convert URLs into the number strings that computers use to find and access websites. Then, for example, when the user types a legitimate bank's URL into the browser window, the computer is misdirected to a bogus but authentic-looking website of the same sort that might be used in a phishing attack. In another scenario, a hacker poisons a more public DNS directory cache (at an ISP, for instance), again leading unsuspecting Internet users to phony sites. (For more on this, see "How DNS Poisoning Works," Page 46.) In either case, potentially large numbers of users are drawn to the fraudulent sites or proxy servers (a computer that sits between the user and the real server and captures information as it passes through), where criminals can track activity and gather credit card data and personal identification numbers." http://www.csoonline.com/article/220629/After_Phishing_Pharming_

Smishing: In computing, Smishing is a form of criminal activity using social engineering techniques similar to phishing. The name is derived from "SMsphISHING". SMS (Short Message Service) is the technology used for text messages on cell phones. Similar to phishing, smishing uses cell phone text messages to deliver the "bait" to get you to divulge your personal information. The "hook" (the method used to actually "capture" your information) in the text message may be a web site URL, however it has become more common to see a phone number that connects to automated voice response system. http://en.wikipedia.org/wiki/SMiShing

Monday, November 16, 2009

Googling-it and how it really works...

How Google works.

Google was founded in September 1998 and has now become one of the most well-known and recognized internet search browsers. Google Inc is an American public corporation that is now not only known for its search engine, but for its e-mail, online mapping, office productivity, social networking and video sharing, but how does such a large internet base work?
Google runs by using parallel processing with three distinct parts. According to Googleguide.com, this process can be explained as “a distributed network of thousands of low-cost computers. Parallel processing is a method of computation in which many calculations can be performed simultaneously, significantly speeding up data processing. Google has three distinct parts:

· Googlebot, a web crawler that finds and fetches web pages.

· The indexer that sorts every word on every page and stores the resulting index of words in a huge database.

· The query processor, which compares your search query to the index and recommends the documents that it considers most relevant.”



How the pages that come up from your search work.

Google uses a process simply known as “page rank,” that adds up a number of different factors to display what hierarchy different sites appear. Google’s “page rank” gives each website a ranking from 1-10 based on certain criteria. The more relevant links you have on your website, the more votes Google will award to your site. More links=more votes. In addition, the higher the points of the links you attach to your website, the more votes your website will receive.



Sources:
http://en.wikipedia.org/wiki/Google
http://www.googleguide.com/google_works.html
http://www.switchit.com/news/improve-pagerank.asp

Monday, November 2, 2009

Day 18

DAY 18: Presentation Foundation/Research

Googles motto: “Do No Evil”

According to Wikipedia, network neutrality simply put is the principle that all Internet traffic should be treated equally. Net neutrality advocates have established three principal definitions of network neutrality:

1. Absolute non-discrimination
2. Limited discrimination without QoS tiering
3. Limited discrimination and tiering

The following is a spoof video talking about Network Neutrality and “saving the internet” http://www.youtube.com/watch?v=cWt0XUocViE



Time to let the process unfold Article on Google Blogspot
Thursday, October 22, 2009 at 12:55 PM ET

Posted by Richard Whitt, Washington Telecom and Media CounselThis morning, the FCC voted unanimously to begin consideration of proposed rules that would protect and promote open broadband pipes to the Internet. Over the next several months, an official rulemaking proceeding will take place, along with public workshops and technical advisory discussions, allowing everyone to provide feedback before the Commission adopts a final set of rules.There's been a lot of noise out there, but let's review what's at stake: The Internet was built and has thrived as an open platform, where individuals and entrepreneurs -- not network owners -- can connect and interact, choose marketplace winners and losers, and create new services and content on a level playing field. No one seems to disagree with that fundamental proposition. This new proceeding is aimed at opening a national dialogue on how best to protect that unique environment. For our part, we fully support the adoption of "rules of the road" to ensure that the broadband on-ramps to the Net remain open and robust.This is a critical debate for the future of the Internet, and no doubt there are different viewpoints on how to move forward. Some detractors unfortunately have gone so far as to work behind the scenes to try to derail the start of an open and transparent process at the Commission. But as Google CEO Eric Schmidt and Verizon Wireless CEO Lowell McAdam showed in last evening's joint blog post, stakeholders can work together with mutual respect to find common ground, even as we acknowledge and defend important policy differences.

http://googlepublicpolicy.blogspot.com/2009/10/finding-common-ground-on-open-internet.html



QUALITY OF SERVICE

Definition: QoS (Quality of Service) refers to a broad collection of networking technologies and techniques. The goal of QoS is to provide guarantees on the ability of a network to deliver predictable results. Elements of network performance within the scope of QoS often include availability (uptime), bandwidth (throughput), latency (delay), and error rate.

QoS involves prioritization of network traffic. QoS can be targeted at a network interface, toward a given server or router's performance, or in terms of specific applications. A network monitoring system must typically be deployed as part of QoS, to insure that networks are performing at the desired level.

QoS is especially important for the new generation of Internet applications such as VoIP, video-on-demand and other consumer services. Some core networking technologies like Ethernet were not designed to support prioritized traffic or guaranteed performance levels, making it much more difficult to implement QoS solutions across the Internet.
http://compnetworking.about.com/od/networkdesign/g/bldef_qos.htm
http://googlewatch.eweek.com/content/google_and_net_neutrality/the_wall_street_journal_fly_in_googles_net_neutrality_ointment.html
http://news.cnet.com/2100-1028_3-6108376.html


FEDERAL COMMUNICATIONS COMMISSION

The Federal Communications Commission (FCC) is an independent United States government agency. The FCC was established by the Communications Act of 1934 and is charged with regulating interstate and international communications by radio, television, wire, satellite and cable. The FCC's jurisdiction covers the 50 states, the District of Columbia, and U.S. possessions.
Bureaus and Offices.

The Commission staff is organized by function. There are seven operating Bureaus and ten Staff Offices. The Bureaus’ responsibilities include: processing applications for licenses and other filings; analyzing complaints; conducting investigations; developing and implementing regulatory programs; and taking part in hearings. Our Offices provide support services. Even though the Bureaus and Offices have their individual functions, they regularly join forces and share expertise in addressing Commission issues.

Consumer & Governmental Affairs Bureau - educates and informs consumers about telecommunications goods and services and engages their input to help guide the work of the Commission. CGB coordinates telecommunications policy efforts with industry and with other governmental agencies — federal, tribal, state and local — in serving the public interest.
Enforcement Bureau - enforces the Communications Act, as well as the Commission’s rules, orders and authorizations.
International Bureau - represents the Commission in satellite and international matters.
Media Bureau - regulates AM, FM radio and television broadcast stations, as well as cable television and satellite services.
Wireless Telecommunications - oversees cellular and PCS phones, pagers and two-way radios. This Bureau also regulates the use of radio spectrum to fulfill the communications needs of businesses, aircraft and ship operators, and individuals.
Public Safety & Homeland Security Bureau - addresses public safety, homeland security, national security, emergency management and preparedness, disaster management, and other related issues.
Wireline Competition Bureau - responsible for rules and policies concerning telephone companies that provide interstate, and under certain circumstances intrastate, telecommunications services to the public through the use of wire-based transmission facilities (i.e., corded/cordless telephones).

Wednesday, October 28, 2009

Day 17

Day 17: Network Concepts

My IP address while using the internet was…

IP Address:
152.33.62.173
Source:
whois.arin.net
Prefix:
152/8
Designation:
Administered by ARIN
Status:
LEGACY
OrgName: Elon University OrgID: ELONUAddress: 100 Campus DriveCity: ElonStateProv: NCPostalCode: 27244-2010Country: US

We used WhatismyIP.com and Whois.net to find out information about our IP address and information on other internet domain addresses.


On “WhoIs” I looked up facebook.com and got the following information…




Registrant:
Facebook, Inc
1601 S. California Ave
Palo Alto, CA 94304
US

Domain name: FACEBOOK.COM


Administrative Contact:
Admin, Domain domain@facebook.com
1601 S. California Ave
Palo Alto, CA 94304
US
+1.6505434800 Fax: +1.6505434800

Technical Contact:
Admin, Domain domain@facebook.com
1601 S. California Ave
Palo Alto, CA 94304
US
+1.6505434800 Fax: +1.6505434800



Registration Service Provider:
Lysand LLC
http://www.lysand.com/
This company may be contacted for domain login/passwords,
DNS/Nameserver changes, and general domain support questions.


Registrar of Record: TUCOWS, INC.
Record last updated on 20-May-2009.
Record expires on 30-Mar-2010.
Record created on 29-Mar-1997.

Registrar Domain Name Help Center:
http://domainhelp.tucows.com

Domain servers in listed order:
NS2.FACEBOOK.COM 204.74.67.132
DNS05.SF2P.TFBNW.NET
DNS04.SF2P.TFBNW.NET
NS1.FACEBOOK.COM 204.74.66.132

Monday, October 26, 2009

Day 16: Interactive Network Activity

-- What was the word you were sent, and what is its definition?-- What was the word you were trying to send, and what is its definition?-- How long does it take you to send your message using this method?-- Was it easier to send or receive a message using this method?-- What were some of the bottlenecks?-- How could you speed up this process or make it more efficient?

The word I was supposed to have received was “factotum,” which is defined by Wikipedia as a general servant or a person having many diverse activities or responsibilities. However, I did not receive my entire message (I only got 4 out of the eight letters) and did not receive or hear the numbers correctly when they were relayed to me, because I got a different first 4 letters than my sender.
The word I sent out was “gremials,” which is defined as being is a square or oblong cloth which a
bishop, according to the "Cæremoniale Episcoporum" and "Pontificale", should wear over his lap, when seated on the throne during the singing of the Kyrie, Gloria and Credo by the choir, during the distribution of blessed candles, palms or ashes, during the washing of feet in the Mass of the Lord's Supper, and also during the anointments in connection with Holy orders.
Using the method we initially used in class, relying messaging between each other was a tedious task, but for the most part people got their messages across. It did take the class close to an hour to relay our different 8-letter-word messages though. I also feel like the people who were louder and more inclined to speak up, were the ones who got the message out more clearly and faster than others.
For me, it was easier sending out messages rather than receiving them, because I could choose when I wanted to send them out, the content in which I was sending out and I was prepared for the task, as opposed to when you receive the message, you have to be ready to write it down, hear it clearly and then decode it.
Some issues or “bottlenecks” that the class ran into were collisions when people started to speak up all at once and there were also some issues with people not hearing their message clearly and having to figure out how to tell their sender the problem. We tried a few different methods of relaying messages through our network and in the end stuck with our original choice, of sending out messages at random.
I believe you could make this task more efficient by utilizing the circle method of allowing each computer/person to say their message and if they have no message send it on to the next person.

Wednesday, October 21, 2009

October 21: Networking thoughts...

Q: What are some creative ways to design a network to handle 1) addressing and 2) communication conflicts in a bus topology?
Addressing can be defined simply as a networks way of finding other computers. A way to help networks find other computers more smoothly and directly would be to name or label each of the computers attached to the network wire of the bus. This could be done a few different ways, either by using numbers, letters or a combination of both to help the network identify where each piece of information is going and to help organize the information when going through the wire.
Having a structured and labeled way of addressing or finding other computers will help to ensure better communication throughout the bus wire and helps to make things run together and more smoothly. Naming them gives the network and address or specific computer of where to send the information, instead of guessing or sending throughout to all. This labeling in beneficial in all sorts of other areas, not just in the computer networking world and helps to make communication run better and faster.