Technology Articles

Article / Updated 06-23-2022

Hackers use a variety of means to gain passwords. One of the most common ways for hackers to get access to your passwords is through social engineering, but they don’t stop there. Check out the following tools and vulnerabilities hackers exploit to grab your password. Keystroke logging One of the best techniques for capturing passwords is remote keystroke logging — the use of software or hardware to record keystrokes as they’re typed. Be careful with keystroke logging. Even with good intentions, monitoring employees raises various legal issues if it’s not done correctly. Discuss with your legal counsel what you’ll be doing, ask for her guidance, and get approval from upper management. Logging tools used by hackers With keystroke-logging tools, you can assess the log files of your application to see what passwords people are using: Keystroke-logging applications can be installed on the monitored computer. Check out Veriato's Cebral, as one example. Dozens of such tools are available online. Hardware-based tools fit between the keyboard and the computer or replace the keyboard. A keystroke-logging tool installed on a shared computer can capture the passwords of every user who logs in. Countermeasures against logging tools The best defense against the installation of keystroke-logging software on your systems is to use an antimalware program or a similar endpoint protection software that monitors the local host. It’s not foolproof but can help. As with physical keyloggers, you’ll need to inspect each system visually. The potential for hackers to install keystroke-logging software is another reason to ensure that your users aren’t downloading and installing random shareware or opening attachments in unsolicited emails. Consider locking down your desktops by setting the appropriate user rights through local or group security policy in Windows. Alternatively, you could use a commercial lockdown program, such as Fortres 101 for Windows or Deep Freeze Enterprise for Windows, Linux, and macOS X. A different technology that still falls into this category is Carbon Black’s “positive security” allow listing application, called Cb Protection, which allows you to configure which executables can be run on any given system. It’s intended to fight off advanced malware but could certainly be used in this situation. Weak password storage Many legacy and stand-alone applications — such as email, dial-up network connections, and accounting software — store passwords locally, which makes them vulnerable to password hacking. By performing a basic text search, you can find passwords stored in clear text on the local hard drives of machines. You can automate the process even further by using a program called FileLocator Pro. How hackers search for passwords You can try using your favorite text-searching utility — such as the Windows search function, findstr, or grep — to search for password or passwd on your computer's drives. You may be shocked to find what’s on your systems. Some programs even write passwords to disk or leave them stored in memory. Weak password storage is a criminal hacker’s dream. Head it off if you can. This doesn’t mean that you should immediately run off and start using a cloud-based password manager, however. As we’ve all seen over the years, those systems get hacked as well! Countermeasures against weak passwords The only reliable way to eliminate weak password storage is to use only applications that store passwords securely. This practice may not be practical, but it’s your only guarantee that your passwords are secure. Another option is to instruct users not to store their passwords when prompted. Before upgrading applications, contact your software vendor to see how it manages passwords, or search for a third-party solution. How hackers use network analyzers to crack passwords A network analyzer sniffs the packets traversing the network, which is what the bad guys do if they can gain control of a computer, tap into your wireless network, or gain physical network access to set up their network analyzer. If they gain physical access, they can look for a network jack on the wall and plug right in. Finding password vulnerabilities with network analyzers The image below shows how crystal-clear passwords can be through the eyes of a network analyzer. This shows how Cain & Abel can glean thousands of passwords going across the network in a matter of a couple of hours. As you can see in the left pane, these clear text password vulnerabilities can apply to FTP, web, Telnet, and more. (The actual usernames and passwords are blurred to protect them.) If traffic isn’t tunneled through some form of encrypted link (such as a virtual private network, Secure Shell, or Secure Sockets Layer), it’s vulnerable to attack. Cain & Abel is a password-cracking tool that also has network analysis capabilities. You can also use a regular network analyzer, such as the commercial products Omnipeek and CommView, as well as the free open-source program Wireshark. With a network analyzer, you can search for password traffic in various ways. To capture POP3 password traffic, for example, you can set up a filter and a trigger to search for the PASS command. When the network analyzer sees the PASS command in the packet, it captures that specific data. Network analyzers require you to capture data on a hub segment of your network or via a monitor/mirror/span port on a switch. Otherwise, you can’t see anyone else’s data traversing the network — just yours. Check your switch’s user guide to see whether it has a monitor or mirror port and for instructions on how to configure it. You can connect your network analyzer to a hub on the public side of your firewall. You’ll capture only those packets that are entering or leaving your network — not internal traffic. Countermeasures against network analyzers Here are some good defenses against network analyzer attacks: Use switches on your network, not hubs. Ethernet hubs are things of the past, but they are still used occasionally. If you must use hubs on network segments, a program like sniffdet for Unix/Linux-based systems and PromiscDetect for Windows can detect network cards in promiscuous mode (accepting all packets, whether they’re destined for the local machine or not). A network card in promiscuous mode signifies that a network analyzer may be running on the network. Make sure that unsupervised areas, such as an unoccupied lobby or training room, don’t have live network connections. An Ethernet port is all someone needs to gain access to your internal network. Don’t let anyone without a business need gain physical access to your switches or to the network connection on the public side of your firewall. With physical access, a hacker can connect to a switch monitor port or tap into the unswitched network segment outside the firewall and then capture packets. Switches don’t provide complete security because they’re vulnerable to ARP poisoning attacks. How hackers break weak BIOS passwords Most computer BIOS (basic input/output system) settings allow power-on passwords and/or setup passwords to protect the computer’s hardware settings that are stored in the CMOS chip. Here are some ways around these passwords: You usually can reset these passwords by unplugging the CMOS battery or by changing a jumper on the motherboard. Password-cracking utilities for BIOS passwords are available on the Internet and from computer manufacturers. If gaining access to the hard drive is your ultimate goal, you can remove the hard drive from the computer and install it in another one, and you’re good to go. This technique is a great way to prove that BIOS/power-on passwords are not effective countermeasures for lost or stolen laptops. Check cirt.net for a good list of default system passwords for various vendor equipment. Tons of variables exist for hacking and hacking countermeasures depending on your hardware setup. If you plan to hack your own BIOS passwords, check for information in your user manual, or refer to the BIOS password-hacking guide. If protecting the information on your hard drives is your ultimate goal, full (sometimes referred to as whole) disk is the best way to go. The good news is that newer computers (within the past five years or so) use a new type of BIOS called unified extensible firmware interface (UEFI), which is much more resilient to boot-level system cracking attempts. Still, a weak password may be all it takes for the system to be exploited. Weak passwords in limbo Bad guys often exploit user accounts that have just been created or reset by a network administrator or help desk. New accounts may need to be created for new employees or even for security testing purposes. Accounts may need to be reset if users forget their passwords or if the accounts have been locked out because of failed attempts. Password weaknesses in user account Here are some reasons why user accounts can be vulnerable: When user accounts are reset, they’re often assigned an easily cracked or widely-known password (such as the user’s name or the word password). The time between resetting the user account and changing the password is a prime opportunity for a break-in. Many systems have default accounts or unused accounts with weak passwords or no passwords at all. These accounts are prime targets. Countermeasures against passwords in limbo The best defenses against attacks on passwords in limbo are solid help-desk policies and procedures that prevent weak passwords from being available at any given time during the new-account-generation and password-reset processes. Following are perhaps the best ways to overcome this vulnerability: Require users to be on the phone with the help desk or to have a help-desk member perform the reset at the user’s desk. Require that the user immediately log in and change the password. If you need the ultimate in security, implement stronger authentication methods, such as challenge/response questions, smart cards, or digital certificates. Automate password reset functionality via self-service tools on your network so that users can manage most of their password problems without help from others.

Article / Updated 06-23-2022

If you have your own website, you can use the Google Translate extension to automatically have your website translated into more than 90 languages. So, there’s no need to have multiple versions of your website created. Google Translate requires code to be placed on every page of your site, so you need some website know-how to do this. If you have a small website, you may be able to add the code to every page. However, if it’s a large site, you’ll want to use some kind of template to place the code on every page, depending on the platform your website is on. Here’s how to add Google Translate to your site: In a web browser, go to translate.google.com. At the bottom of the page, click Website Translator. On your first time visiting the Website Translator, you see a page asking you to add your website. Click the blue Add to Your Website Now button. Type in the URL of your site. For example, www.dummies.com. Choose the language your site is in, such as English. Click Next. Choose whether you want your site translated into All Languages or Specific Languages. If you choose Specific Languages, you see a list in which you can check the languages you want. Under Display Mode, choose how you want the Website Translator banner to appear on your site. Clicking each radio button shows how the box will display. Under Advanced, decide whether to check these options: Automatically display translation banner: If your site is in English, and someone who has their browser set to display French, then the translation banner automatically appears. The banner won’t appear for people whose language is the same as your site’s. Your page has content in multiple languages: Check this box if your site contains different languages, so that the plugin knows to expect content in different languages. Track translation data using Google Analytics: If you use Google Analytics to monitor the traffic on your site, you can view data on the usage of the plugin on your site. When you check that box, you will need to provide your Google Analytics property ID number, such as UA-55555-55. Click Get Code. You’ll get two pieces of code that you need to place on your site. The first piece of code, which is the tag, goes in the header (that is, between the tags) of your HTML pages. The second piece of code, which is in and tags, goes where you want the translation banner to appear on your pages. This code determines what the translation banner looks like and how it behaves. <p class="Warning">How you place the code on your site depends largely on the platform you use. Some platforms, like WordPress, make it easy to place code on all pages of the site. However, if you’re not sure how to do this, you should seek out someone with website know-how to help you out. Otherwise, you could mess up the appearance of your pages.</p>

Cheat Sheet / Updated 06-07-2022

Laptops offer a world of convenience for seniors, but they can be a little intimidating too. To get started off right, see this checklist for what to look for before buying your laptop. After you've purchased your laptop, follow these care and maintenance tips to prolong its life. To round out your experience, here are some handy keyboard shortcuts for getting things done fast in Windows applications and ten useful websites for seniors.

Cheat Sheet / Updated 06-02-2022

Whether you're new to video editing or have some experience, this Cheat Sheet is a handy reference for how to set up a new Premiere Pro CC project, import content to the workspace, and export your finished movie.

Article / Updated 05-31-2022

For each web coding issue identified by a validator, you need to determine what course of action to take. Although some culprits that repeatedly crop up are easy to fix, such as missing alt text and </span> tags, you’re bound to find coding issues that completely baffle and stump you. For instance, if you get an error message that reads <span class="code">XML Parsing Error: Opening and ending tag mismatch: br line 52 and body</span>, it might be difficult to figure out what that means, let alone why it was caused and how you should fix it. As a strategy then, try to fix the issues within the code from the top down, as they’re listed in the validation results, because sometimes fixing one issue resolves another. With the XML parsing error, that issue might disappear when you correct for an omitted closing element on a <span class="code"><br /></span> tag listed earlier in the error results. The best way to find out how to code better and make fewer mistakes before validation testing is to make lots of honest mistakes and figure out how to correct them on your own. Most often, you can fix noncompliant code by hand or with the help of a good HTML editor. To help you identify some of the more common coding mistakes, here several code issues along with suggestions about how to fix them. <table> <tbody> <tr> <th>Problem</th> <th>Solution</th> </tr> <tr> <td> <pre class="code">alt</pre> text attribute missing from <pre class="code"><img></pre> tag</td> <td>Add the alternative text attribute, either with or without a description, as in <pre class="code"><img src="images/logo.gif" width="150" height="150" alt="Pete’s Pizza"> <img src="images/flourish.gif" width="200" height="150" alt=""></pre> .</td> </tr> <tr> <td> <pre class="code"><noscript></pre> tags missing from code</td> <td>Add <pre class="code"><noscript></pre> tags below each instance when JavaScript is present in in-line JavaScript or at the end of the content before the closing body tag. Between the <pre class="code"><noscript></pre> tags, insert HTML content (text, graphics, media files, and so on) that describes the function of the JavaScript and, when appropriate, how visitors can access the information revealed by it, as shown here: <pre class="code"><script language="JavaScript" src="bookmark.js" type="text/javascript"></script><noscript>The JavaScript used on this page provides a quick link that allows visitors to automatically bookmark this page. As an alternative, please use your browser’s Bookmark This Page feature. Flashing or flickering element(s) detected, such as animated GIFs, Java applets, and other multimedia plug-ins Adjust the speed of any animations to avoid causing the screen to flicker with a frequency between 2 Hz and 55 Hz. Animations that exceed these two measures may cause seizures in visitors with photosensitive epilepsy. No DOCTYPE specified Add a valid DOCTYPE above the opening tag. No HTTP charset parameter specified This special meta tag specifies the character set used in the HTML code. Some HTML editors include it automatically when generating new blank web pages. If validation finds that this tag is missing from your HTML or XHTML code, insert the following code by hand: . For HTML5, insert . No </pre> tag specified</td> <td>Add a unique title between <pre class="code"><title></pre> tags in the head area on each page.</td> </tr> <tr> <td>No <pre class="code"><meta></pre> tags specified</td> <td>Add meta keywords and meta description tags to the head of each page. These can be identical on every page on the site. If desired, you may also add additional meta tags as needed.</td> </tr> <tr> <td>No Robots tags specified</td> <td>Add the <pre class="code">Robots</pre> <pre class="code"><meta></pre> tag in the head of the page to instruct web spiders and robots whether to index the page and follow any hyperlinks, such as <pre class="code"><meta name="Robots" content="All"></pre> .</td> </tr> <tr> <td>Deprecated <pre class="code"><font></pre> tags detected</td> <td>Move all the presentation markup of the HTML (page, fonts, tables, links, and so on) to an external CSS file and remove all <pre class="code"><font></pre> tags and HTML and inline formatting attributes.</td> </tr> <tr> <td>Deprecated table height attribute detected</td> <td>Control table cell heights, when necessary, with CSS styles.</td> </tr> <tr> <td>Style attributes detected in the opening <pre class="code"><body></pre> tag</td> <td>Move <span class="code">body</span> attributes, like margin attributes and background page color, to a BODY tag redefine style in an external CSS file.</td> </tr> <tr> <td> <pre class="code">type</pre> attribute not specified for JavaScript or CSS</td> <td>Add the <pre class="code">type="text/css"</pre> attribute for <pre class="code"><style></pre> tags and the <pre class="code">type="text/javascript"</pre> attribute for <pre class="code"><script></pre> tags: <pre class="code"><style type="text/css" ><script type="text/javascript"></pre> .</td> </tr> <tr> <td>Entity name used instead of entity number</td> <td>Change the entity name to an entity number, such as using <pre class="code">$#169;</pre> instead of <pre class="code">©</pre> to create the copyright symbol (c).</td> </tr> <tr> <td>No background color attribute was specified for a CSS style that specifies text color</td> <td>Provide each style that contains a text <pre class="code">color</pre> attribute with an attending background <pre class="code">color</pre> attribute. The background color should match, or closely match, the background color upon which the text will display on.</td> </tr> </tbody> </table> When you’re finished identifying and adjusting all the noncompliant code identified by the validation tools, and have fixed everything that needed fixing, move on to the retesting and acceptable failure phase of the testing process.

Article / Updated 05-27-2022

Amazon's Kindle e-Reader does a great job of displaying eBooks — including your own personal PDFs, if you are using a Kindle 2 or Kindle DX. The only problem is finding out how to copy a PDF from your computer to the Kindle. (And few things are more frustrating than having an e-Reader that doesn't read your own documents!) Luckily, it only takes a few easy steps to move a PDF file from your PC or Mac to your Kindle. Locate the PDF file either on your desktop or within the file browser. Connect the Kindle to your computer via USB cable. It should appear in your file browser (such as Finder on Mac or Explorer on Windows) as if you attached an external USB drive. Locate the "documents" folder within the Kindle. You can do this within your file browser by opening the Kindle icon/folder and then navigating to the "documents" folder. Drag and drop the PDF file from the original location to the Kindle "documents" folder. If you have an older Kindle, you can still read the text from PDFs on your e-Reader — after you convert them. Amazon will do this for a small fee, or you can look for freeware utilities online. For newer Kindles, you may still want to convert the PDF so that you can take advantage of the Kindle's text manipulation features (like increasing/decreasing font size).

Article / Updated 05-27-2022

Connecting your PlayStation 3 to a wireless network is the first step to joining in the world of online gaming. Almost all versions of the PS3 (all except the 20GB) have a built-in wireless capability. Many of today's most popular games operate entirely over online game servers and those that don't usually have an option for online game play. When you connect your PS3 to a wireless network you can play against other online gamers around the world. Online gamers can participate in tournaments and operate in team with each other for a whole new game experience. All you need to get started is a wireless access point. Turn off all your network equipment (modem and router) as well as the PlayStation 3. Leave all equipment off for two full minutes. Turn on your modem and router. Make sure that your wireless router is connected to the Internet and broadcasting a signal. Use a PC to ensure that all router settings are complete before turning on the PS3. Turn on the PS3. Select Settings→Network Settings on the XMB and click the X button. Now you’ll need to provide your router’s security settings. If the PS3 is connected to a modem using an Ethernet cable, the wireless function will be turned off. Choose Internet Connections and select Enabled. Then scroll to Internet Connection Settings and press the X button. If you receive a message saying that you'll be disconnected from any current Internet Connection, say Yes to move on. Select the Easy option and press the X button. Try the Easy setup first; if that fails then you can always go back and try the Custom settings. Select Wireless and press the X button. Then select Scan and press the X button. The PS3 will scan the surrounding area and produce a list of all the nearby wireless access points. If you have an AOSS (AirStation One-Touch Secure System) router, select Automatic instead and follow the onscreen commands. Select your access point from the list and press the X button. If you're not sure which SSID is yours, check with the person you set up your router. Confirm your SSID and press the X button. Select the security type that your router uses and press the X button again. You may need to ask the network administrator for the appropriate information. Enter the necessary security key information and press the Start button. Press the Right Arrow button to move to the next screen. The security key will always look like eight asterisks (*) regardless of how long it actually is. Enter any additional security information required by your router. When you're finished, press the X button to save the settings. This will store the settings on your PlayStation 3 permanently, so that next time you just have to choose you network and you're ready to go. Press the X button again to test the network. Your PS3 will attempt to connect to the Internet. Hopefully, you'll see Succeeded beside each attempt. If you receive a failed signal, turn everything off and try the set up again.

Cheat Sheet / Updated 05-03-2022

If you're just getting started writing computer programs, you need to learn programming branching and looping statements to perform the specific jobs you need for an effective program. Keeping a list of computer programming resources for useful information handy can help, too.

Cheat Sheet / Updated 05-02-2022

QuickBooks 2019 makes small-business accounting fast and easy. But your day-to-day business bookkeeping will go even more smoothly if you employ a handful of QuickBooks user interface tricks, editing tricks, and keyboard shortcuts.

Cheat Sheet / Updated 05-02-2022

To complete any project using R, you work with functions that live in packages designed for specific areas. This cheat sheet provides some information about these functions.