Iranian hacker claims credit for SSL certificate theft

'ComodoHacker' splits security research community, downplays political motivation

By Gregg Keizer | Computerworld

 

A solo Iranian hacker on Saturday claimed responsibility for stealing multiple SSL certificates belonging to some of the Web's biggest sites, including Google, Microsoft, Skype, and Yahoo.
Early reaction from security experts was mixed, with some believing the hacker's claim, while others were dubious.
[ Also on InfoWorld.com, Woody Leonhard asks how Comodo could have let the attackers in, and Robert Lemos examines the implications of the breach on the larger security community. | Learn how to secure your Web browsers in InfoWorld's "Web Browser Security Deep Dive" PDF guide. ]
Last week, conjecture had focused on a state-sponsored attack, perhaps funded or conducted by the Iranian government, that hacked a certificate reseller affiliated with U.S.-based Comodo.
On March 23, Comodo acknowledged the attack, saying that eight days earlier, hackers had obtained nine bogus certificates for the log-on sites of Microsoft's Hotmail, Google's Gmail, the Internet phone and chat service Skype, and Yahoo Mail. A certificate for Mozilla's Firefox add-on site was also acquired.
SSL certificates validate the legitimacy of a website to the browser, assuring users that they're connecting to the real site, and that the traffic between their browsers and the site is encrypted.
Comodo CEO Melih Abdulhayoglu said last week that circumstantial evidence pointed to a state-backed attack and claimed the Iranian government was probably behind it. "We believe these are politically motivated, state-driven/funded attacks," said Abdulhayoglu.
He based his opinion on the fact that only Iran's government -- which could jigger the country's DNS to funnel traffic through fake sites secured by the stolen certificates -- would benefit.
In Abdulhayoglu's analysis, authorities could have used the certificates to dupe antigovernment activists into believing they were at a legitimate Yahoo Mail site, for example. In reality, however, the phony sites would have collected usernames and passwords, and thus given the government access to their email or Skype accounts.
On Sunday, a single hacker took responsibility for the Comodo attack, backing up his claim with decompiled code.
"I'm not a group of hacker [sic], I'm single hacker with experience of 1,000 hackers," wrote the attacker in a post on Pastebin.com late Saturday. He called himself "ComodoHacker" and said he's 21 years old.
ComodoHacker alleged that he had gained full access to InstantSSL.it, the Italian arm of Comodo's InstantSLL certificate selling service, then decompiled a DLL file he found on its server to uncover the reseller account's username and password.
With the username and password in hand, said ComodoHacker, he was able to generate the nine certificates, "all in about 10 to 15 minutes." His message was signed "Janam Fadaye Rahbar," which reportedly means "I will sacrifice my soul for my leader."
The InstantSLL.it website is currently offline.
Robert Graham, the CEO of Errata Security, believes ComodoHacker is telling a straight story.

"As a pentester who does attacks similar to what the ComodoHacker did, I find it credible," Graham said Sunday on the Errata blog. "I find it probable that (1) this is the guy, (2) he acted alone, (3) he is Iranian, (4) he's patriotic but not political."
But Mikko Hypponen, the chief research officer of Helsinki-based F-Secure, sounded skeptical.
"Do we really believe that a lone hacker gets into a [certificate authority], can generate any cert he wants...and goes after login.live.com instead of paypal.com?" asked Hypponen on Twitter.
Graham had an answer for Hypponen's question.
"[Comodo Hacker] started with one goal, that of factoring RSA keys, and ended up reaching a related goal, forging certificates," said Graham. "He didn't think of PayPal because he wasn't trying to do anything at all with the forged certificates."
ComodoHacker also lit into the West -- Western media in particular -- for quickly concluding that the Iranian government was involved when it had downplayed possible U.S. and Israeli connections to Stuxnet, the worm that most experts believe was aimed at Iran's nuclear program.
He also threatened to unleash his skills against those he said were enemies of Iran.
"Anyone inside Iran with problems, from fake Green Movement to all MKO members and two-faced terrorists, should [be] afraid of me personally," said ComodoHacker. "I won't let anyone inside Iran, harm people of Iran, harm my country's Nuclear Scientists, harm my Leader (which nobody can), harm my President."
MKO, or the "People's Mujahedin of Iran," is an Islamic group that advocates the overthrow of the current government of Iran.
"As I live, you don't have privacy in Internet, you don't have security in digital world, just wait and see," ComodoHacker said.
Comodo was not available Sunday for comment on ComodoHacker's claims.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.
Read more about security in Computerworld's Security Topic Center.

Computerworld is an InfoWorld affiliate.



source:http://www.infoworld.com/d/security/iranian-hacker-claims-credit-ssl-certificate-theft-878?page=0,1

 

Forget Social Security numbers -- cyber criminals want your intellectual property

A report warns companies to drop reactive approach to network security or risk losing data to increasingly sophisticated hackers

By Ted Samson | InfoWorld

 

If you thought protecting your customer and employee data like Social Security numbers and bank information against two-bit hackers was challenging, brace yourself: A report released by McAfee and SAIC (Science Applications International Corporation) titled "Underground Economies," says that cyber criminals are growing craftier and have their eyes on the troves of unprotected intellectual property floating around your company networks and all the devices and networks your networks touch.
The report concludes that intellectual capital and sensitive corporate data are the latest cyber crime currency. More than that, the old-school approach of perimeter-based security and "check the box" compliance won't cut it in era of mobile and cloud computing.
These findings likely won't come as much of a shocking revelation to anyone who has been paying close attention to cyber crime trends over the past couple of years, as cyber crime organizations have successfully infiltrated countless organizations through such techniques as APTs (advanced persistent threats). The trend has likely drawn more attention, however, in the wake of news that high-profile companies like RSA, HBGary, Google, energy companies, and Bank of America have lost sensitive documents and important information through sophisticated hack attacks.
McAfee and SAIC attribute the growing trend toward intellectual theft to the increasingly porous nature of the corporate network: "With the perimeter continuing to dissolve due to enterprises extending operations to mobile devices, cloud computing, and to third-party providers, containing intrusion vectors is getting more and more difficult," wrote Simon Hunt, VP and CTO of endpoint security at McAfee.
The question is, how can an organization protect itself from the sort of sophisticated attacks that can be pulled off at just about any time by anyone? The whodunit aspect is indeed tricky because outsiders have become increasingly adept at posing as insiders. "Sophisticated attackers infiltrate a network, steal valid credentials on the network, and operate freely -- just as an insider would," said Scott Aken, vice president for cyber operations at SAIC. "Having defensive strategies against these blended insider threats is essential, and organizations need insider threat tools that can predict attacks from this blended threat."
Too often, organizations are working reactively rather than staying ahead of the bad guys. Further, they're investing in technologies that don't go far enough to documents containing intellectual property and other sensitive information that might be sent around via email to various mobile devices or stored on a remote server in Russia or China. Compounding the challenge: Protecting documents containing simple data, such as Social Security numbers, is more difficult than securing files containing complex data that lacks patterns a data-loss prevention system can easily identify.
According to McAfee and SAIC, companies are embracing new strategies to combat today's cyber criminal tactics. They include:

• Deep packet inspection, a means of performing inline, full packet analysis in near real time. DPI can be employed to strip data off packets leaving a network, as well as to strip suspicious data from incoming traffic.
• Human-behavior based network security, comprising solutions that watch for certain types of behaviors that a human being would undertake if they were working to infiltrate a network
• Insider threat tools, capable of monitoring hundreds or even thousands of inside users' activities at line speed and identifying traits inherent in those actions. These products are capable of interrupting a user's connection if they identify a user engaging in suspicious or unusual activities.
• Advanced forensics, software tools and services that help uncover how a particular device, be it computer or handheld, was exploited
• Advanced malware analysis, with which one can discover and capture zero-day malware can be used or is being used to attack a network.

The McAfee/SAIC report "Underground Economies" is available for free download on McAfee's site (PDF).
This story, "Forget Social Security numbers -- cyber criminals want your intellectual property," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

Tags: cyber crime, hacking, insider threats

 

 

 

 

source :http://www.infoworld.com/d/security/forget-social-security-numbers-cybercriminals-want-your-ip-000

McAfee's website full of security holes, researcher says

The portion of the site that could be used for cross-site scripting attacks host some of McAfee's files for downloading software

By Julie Bort | Network World

 

The McAfee.com website is full of security mistakes that could lead to cross-site scripting and other attacks, researchers said in a post on the Full Disclosure site on Monday. The holes with the site were found by the YGN Ethical Hacker Group, and reported to McAfee on Feb. 10, YGN says, before they were publicly disclosed to the security/hacking mailing list.
In addition to cross-site scripting, YGN discovered numerous information disclosure holes with the site including seeing an internal hostname and finding 18 source code disclosures. The portion of the site that could be used for cross-site scripting attack hosts some of McAfee's files for downloading software, YGN says on its Full Disclosure post.
[ Find out how to block the viruses, worms, and other malware that threaten your business, with hands-on advice from InfoWorld's expert contributors in InfoWorld's "Malware Deep Dive" PDF guide. ]
MORE HACKS: Microsoft warns of hack attempt on Windows Live, Google, Yahoo, Skype, Mozilla
This isn't just embarrassing, but also somewhat discrediting for McAfee, which markets a McAfee Secure service to enterprises for their customer-facing websites. McAfee Secure scans a website daily for "thousands of hacker vulnerabilities," the company advertises. If the site is found to "be certified" to McAfee's "high standard of security," then users of McAfee anti-malware products see a "McAfee Secure" label in their browsers. McAfee Secure claims to test for personal information access, links to dangerous sites, phishing, and other embedded malicious dangers that a website might unknowingly be hosting.
"In other words, the presence of this label means that the website is not vulnerable to the exact same vulnerabilities [McAfee.com] currently has," writes security researcher Pablo Ximenes, from the Information Security Research Team of the University of Puerto Rico at Mayaguez, in his blog. "Don't get me wrong, I have no interest in damaging McAfee's image, I even own a company that sells McAfee products, but this is a serious lack of diligence with customers and resellers that must not go unnoticed," he writes.
According to YGN, after reporting the flaws on the McAfee website to the vendor on Feb. 10, McAfee responded to the report on Feb. 12, saying, "We are working to resolve the issue as quickly as possible." When, as of March 27, YGN found the flaws "to be unfixed completely," YGN publicly disclosed them. YGN offered two tongue-in-cheek recommendations to McAfee for addressing the issues: that the company should make better use of its own internal website security experts from Foundstone, a Web security services company McAfee acquired in 2004, and that the company should "use outbound monitoring of traffic to detect potential information leakage."
This is not the first time that McAfee's website was found to be lacking security. In 2008, websites from McAfee, Symantec, and VeriSign were all found to have cross-site scripting errors, according to security watchdog at the time XSSed.
Additionally, in 2009, white-hat hacker Methodman, a member of the Team Elite, published proof-of-concept attacks against websites kc.mcafee.com and mcafeerebates.com. In April 2010, the McAfee.com community forums were defaced via an XC scripting attack.
McAfee told Network World that it is investigating the Full Disclosure vulnerabilities report.
Bort writes the Microsoft Update, Source Seeker and Cisco Odds and Ends blogs for Network World's Microsoft Subnet, Open Source Subnet and Cisco Subnet communities. Follow Bort on Twitter @Julie188.
Read more about wide area network in Network World's Wide Area Network section.

Network World is an InfoWorld affiliate.

Tags: web security, malware

 

 

 

source:http://www.infoworld.com/d/security/mcafees-website-full-security-holes-researcher-says-979 

 

Amazon's cloud new offers dedicated hardware

Amazon is aiming to lower entry barriers for its cloud services, says an analyst

By Mikael Ricknäs | IDG News Service

 

AWS (Amazon Web Services) customers can now run their cloud applications on hardware dedicated to them, the company said on Monday.
Amazon's EC2 (Elastic Compute Cloud) uses virtualization, based on a customized version of the Xen hypervisor, to run multiple OSes and customers on a single physical machine. However, that way of running an IT infrastructure isn't a good fit for all users as some have regulatory or other restrictions that require physical isolation, according to an Amazon blog post. The company's introduction of Dedicated Instances addresses those issues, the blog said.
[ Get the no-nonsense explanations and advice you need to take real advantage of cloud computing in the InfoWorld editors' 21-page Cloud Computing Deep Dive PDF special report. | Stay up on the cloud with InfoWorld's Cloud Computing Report newsletter. ]
Dedicated Instances will be part of Amazon's VPC (Virtual Private Cloud) service, which was recently upgraded with better network features. When configuring the VPC, administrators can either set up a private cloud that contains only dedicated instances or one that includes a mixture of traditional and dedicated instances, depending on application requirements, according to Amazon.
Users have no control over whether dedicated instances run on the same hardware or are spread across several machines, although Amazon said that it strives for the latter to minimize the effects of hardware failure.
The charge for Dedicated Instances includes two fees: an hourly "per instance usage fee" and a "dedicated per region fee". The region fee is US$10 per hour irrespective of how many instances an enterprise is running in one region.
The usage fee depends on the region where the instance is running, performance level and OS. For example, a large instance running Suse Enterprise Linux in North Carolina costs $0.54 per hour.
AWS users can also choose to pay a one-time payment for each instance -- signing either a one-year or a three-year contract -- and in return receive a discount on the hourly usage charge.
Companies that just want regular instances only pay the usage fee, which is slightly lower that the one paid by Dedicated Instance users. They also have more instances to pick between and regions where they can run them. Amazon has decided to add the region fee because it won't be able to use its hardware as effectively, the blog post said.
Allowing companies to run applications on dedicated hardware may go against the idea of cloud services and virtualization, according to Niklas Zandelin, CEO at marketing research company Exido. However, for Amazon it is a way to lower entry barriers for its services, he said. Moving to the cloud is still an evolutionary process for most companies and by allowing them to use dedicated hardware, Amazon could start attracting customers earlier in that process.
Send news tips and comments to mikael_ricknas@idg.com

Tags: iaas, Amazon Web Services 

 

 

 

source:http://www.infoworld.com/d/cloud-computing/amazons-cloud-new-offers-dedicated-hardware-910

 

Java founder Gosling joins Google

Java legend James Gosling decided to leave Oracle after it purchased Sun Microsystems

By Chris Kanaracus | IDG News Service

 

Java founder James Gosling has taken a job with Google, he revealed in a blog post on Monday.
"Through some odd twists in the road over the past year, and a tardis encountered along the way, I find myself starting employment at Google today," Gosling wrote. "One of the toughest things about life is making choices. I had a hard time saying 'no' to a bunch of other excellent possibilities."
[ InfoWorld's Paul Krill reported earlier this month that Gosling believes Oracle's self-interest requires good stewardship of Java. | Keep up with the latest Java developments with the JavaWorld Enterprise Java newsletter. ]
"I don't know what I'll be working on," he added. "I expect it'll be a bit of everything, seasoned with a large dose of grumpy curmudgeon."
Gosling left Oracle last year after it purchased Sun Microsystems, the company where he created Java, the now-ubiquitous programming language. While initially somewhat vague about the reasons for his departure, Gosling later told eWeek that the reasons included inadequate compensation and an atmosphere of micromanagement.
His arrival at Google comes as the company is being sued by Oracle over alleged Java patent and copyright infringements in its Android OS. That matter and others have raised tensions in the Java community of late.
"Developers are unsure what future controls Oracle will try to foist over the Java community," said Redmonk analyst Michael Coté. "It's hard for many Java developers to feel sympathy for anything less than a very, very open Java after it was open-sourced many years ago."
It makes sense for Google to bring aboard a figure with Gosling's prominence and background, according to Coté.
"Google has hired some of the larger thought and technical leaders in the Java world," he said. "Having them on board and, important to this point, working on Java, certainly would give Google a bigger voice in the Java community."
In addition, Gosling is "clearly a good coder and a legend in the field, as it were," he said. "He's exactly the kind of person Google likes to collect up and use its cushy position to fund and, hopefully, let flower into new innovations."
Chris Kanaracus covers enterprise software and general technology breaking news for The IDG News Service. Chris's email address is Chris_Kanaracus@idg.com

Tags: java programming, application development, open source software, technology business, Google, Oracle 

 

 

 

source:http://www.infoworld.com/d/applications/java-founder-gosling-joins-google-932

 

Analysis: How MySQL.com and Sun.com got hacked

Hackers broke into the MySQL.com and Sun.com websites using, of all things, a SQL injection technique

By Woody Leonhard | InfoWorld

 

There are lots of red faces at Oracle this morning, as two of its sites, MySQL.com and Sun.com, were pwned over the weekend by veteran Romanian extremely-dark-gray-hat hacker TinKode and sidekick Ne0h. The sites were the victims of an as-yet-unidentified "blind" SQL injection technique -- the exact type of attack you'd think the devs and admins at MySQL would know how to protect against. Apparently, you'd be wrong.
Here's how it happened: Early on Sunday morning, Jackh4xor sent a message to the Full Disclosure mailing list explaining that MySQL.com was "vulnerable to blind SQL injection vulnerability." The message lists the target site as the MySQL.com customer view page. There's an impressive roster of databases, tables, and fields swiped from the MySQL.com site, as well as a short collection of usernames and passwords, both in their encrypted and unencrypted forms.
Shortly after, a lengthy listing claiming to come from TinKode and Ne0h at Slacker.Ro in Romania appeared on Pastebin. TinKode (or more accurately, someone using the handle TinKode) has been, uh, credited with cracking into a U.S. Army site, Eset, NASA, the U.K. Ministry of Defense, Reuters, and others. TinKode also calls Jackh4x0r "our friend," and he claims that he and Ne0h found the offending vulnerability in January.
TinKode's listing includes several key usernames, such as "sys" and "sysadm," alongside their cracked passwords -- most likely extracted from the encrypted passwords using rainbow tables. The password for sys is "phorum5"; for sysadm, it's "qa." Apparently some of the site admins couldn't be bothered with complex passwords.
The MySQL.com site includes several WordPress blogs (WordPress runs on MySQL), and TinKode and Ne0h were kind enough to tell the world the IDs and passwords that go along with many of them. The former MySQL director of project management (who hasn't updated his blog since June 2009) had a username of "admin" and a password of "6661." The former VP of community relations (who's not blogged since January 2010) also ran with a username of "admin," accompanied by a password of "grankulla." I guess the higher-ups had trouble with complex passwords, as well.
Worth noting: MySQL.com wasn't hacked with purloined or guessed passwords. TinKode and Ne0h broke in with a blind SQL injection, targeting the interface, not the database. TinKode also claims to have pwned MySQL.fr, MySQL.it, jp.MySQL.com, and MySQL.de.
TinKode's description of the Sun.com crack seems anticlimactic, with a list of pillaged tables and fields, along with a handful of email addresses, but no passwords. It isn't clear if they didn't find passwords, if they just neglected to pass them on, or if they're holding onto them for further nefarious ends. It also isn't clear if Sun.com fell to the same injection technique used on MySQL.com.
Quis custodiet ipsos custodes? These days, it's hard to tell.
This article, "Analysis: How MySQL.com and Sun.com got hacked," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest business technology news, follow InfoWorld.com on Twitter.

Tags: hacking, data security, network security, password security, government 

 

 

 

source:http://www.infoworld.com/t/hacking/analysis-how-mysqlcom-and-suncom-got-hacked-909

 

Yahoo to release code for selected technologies to open source community

Yahoo is seeking support for technologies that will provide significant value outside of company

 

Yahoo plans to release some technologies, including storage technologies, to the open source community, a senior executive of the company said.
These are systems that Yahoo built to help it handle large numbers of users on its websites, but that don't necessarily give it a competitive advantage, said David Chaiken, chief architect at Yahoo, in an interview in Bangalore on Friday.
[ Get your websites up to speed with HTML5 today using the techniques in InfoWorld's HTML5 Deep Dive PDF how-to report. | Learn how to secure your Web browsers in InfoWorld's "Web Browser Security Deep Dive" PDF guide. ]
In 2009, Yahoo donated its Traffic Server scalable caching proxy to the Apache Software Foundation.
A working group on open source at Yahoo is currently evaluating technologies that could qualify to be released to open source.
The company has to first make sure that each of the technologies will really be useful and provide significant value outside Yahoo, before releasing it to open source, Chaiken said. It takes time and effort to go through the open source process, and to build a community around open source, so the company has to first make sure there will be interest from developers, he added.
Releasing technology to the open source community helps Yahoo build recognition and a technical brand in the technical community, as well as develop relationships with universities and companies, Chaiken said. There could also be some financial benefits in getting community developers to work on a project, he added.
A large part of Yahoo's IT infrastructure is built around open source software, including the Hadoop scalable distributed computing platform, which helps Yahoo execute at a very large scale, Chaiken said.
Yahoo said earlier this year that it is discontinuing its distribution of Hadoop and will instead focus on Apache Hadoop, a project of the Apache Software Foundation.
Hadoop is likely to be critical as Yahoo attempts to reduce diversity and unify its IT infrastructure. The company is for example standardizing its asynchronous or batch computation and storage using Hadoop, Chaiken said.
As a result of acquisitions and in-house projects that were rushing to bring new products and technologies to market, Yahoo over the years ended up with a lot of different systems that in some cases are fulfilling the same purpose, Chaiken said.
Each of the different science groups that were writing algorithms for extracting signal from the company's data were essentially operating on their own dedicated analytics infrastructure and storage, each building different models in a slightly different way, and each operating on different data sets, Chaiken said.
In the last four years, Yahoo has integrated the infrastructure for the science groups across the world, and removed the data and algorithm silos, he added.
Yahoo is also working on unifying its content and communications systems, on top of a "content agility platform" that depends to a large extent on Hadoop, Chaiken said. The company is in the process of unifying its media and communications properties.
John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's email address is john_ribeiro@idg.com.

Tags: open source software, big data, Internet, development environments, it strategy, hadoop, Web Services, data center, Yahoo

 source:http://www.infoworld.com/d/open-source-software/yahoo-release-code-selected-technologies-open-source-community-888

Top 10 presentation tool

1. AuthorSTREAM

---

With AuthorSTREAM, you can take your PowerPoint presentations and upload them to be shared with others. You can download the presentations that you create to embed them in blogs and send them to your favorite video hosting site. The basic service is free, the premium services boost the number of presentations you can have.

2. Empressr

---

This application takes your slides, video, audio and photos and allows you to Empress your colleagues with cool looking presentations. You can share your work on all of the social media sites, or keep it private. The on-line library helps you to manage your media assets quickly.

3. Google Docs Presentation

---

With Google Presentation, you can import video, slides, and tables to make a show. You can collaborate with others all over the world using this application. After creation with this no frills program, you can download your finished project as a PowerPoint file, PDF or text document. You can also upload it to YouTube.

4. myPlick

---

Import most of the major file formats including PDF, OpenOffice, PowerPoint, Word, JPG, MP3 and WMA. You can synch audio with video on your ‘plicks’ and share them with users worldwide. Presentations have to be kept to 150 slides and uploads to 50MB. This is a free service.

5. PreZentit

---

Prezentit is a free presentation application. It offers online editing and collaboration, where you can make changes simultaneously. There is a 250MB upload limit on PreZentit, and you can bring as many people as you want in on a presentation. You can edit your presentations by hand since they are all stored as web pages.

6. Prezi

---

Using Prezi, you can collaborate with others to produce high quality flash documents. The web-based program has an editor that is designed to be intuitive. The basic level of Prezi is free, but there are two levels of subscription which offer you more than the 100MB of disk space that the public license offers.

7. Sliderocket

---

You can upload almost any file format to your presentation, including video from YouTube and information from Google Docs. You can put transitions and effects into your presentations and download the finished product for later viewing. The basic service is free. With a monthly subscription, you can get a good collaboration tool.

8. Spresent

---

You can take content from YouTube or Flickr and create a flash presentation. By embedding your presentations into blogs, emails and web sites, you can get your message across quickly and easily. For $29.95/yr, you can import more file formats and have a copy of Spresent on your desktop.

9. VCASMO

---

VCASMO allows you to upload all kinds of audio and video formats into your presentation. Two of its cool features are video seeking and the ability to add subtitles to your slide. You can keep your presentation public or private, synchronize video and audio, and bring that slideshow to your blog of web page.

10. Zoho Show

---

Zoho offers a wide range of online document applications. Show is a fully collaborative presentation program which can import a wide range of file types. You can export your slide shows to HTML, PowerPoint and PDF. One great feature of Zoho Show is that the presenter can use online chat to communicate with the viewers.
Whether it is from a small cafe in London, or a Starbuck’s in Seattle, you can access your presentation files from anywhere using these web-based applications. Eliminate travel and boarding costs by making your presentations on the internet.

This article is taken from http://aext.net/2010/06/10-leading-presentation-tools/

Mozilla: A new Firefox every 16 weeks

After Firefox 4's release next week, Mozilla hopes to put out new browser versions every four months

By Pete Babb | InfoWorld

Firefox 4 is due out next week,  the culmination of more than a year's work and boasting features like a new tab manager and GPU acceleration. Once the latest Firefox is released, though, Mozilla plans to overhaul its development process so as to bring a new browser version to market every 16 weeks or so rather than the traditional 52 weeks. Is Mozilla feeling the pressure from Google's uber-fast release cycle for Chrome (a new browser every six to eight weeks)? Officially, no -- the company says it just wants to get new features in users' hands as quickly as possible -- but it sure looks like Mozilla's trying to adopt Google's speed-demon ways.
"Chrome's development model has been a successful experiment in terms of getting production releases with improvements and new features out quickly and much faster than in the past," says IDC analyst Al Hilwa. "This is causing waves in the industry, specifically for direct competitors."
According to a release cycle plan posted by Firefox developer Rob Sayre, the new development philosophy is to make new features available more frequently by not holding up new releases to wait for incomplete new features. "Each release happens regardless of whether a given feature is ready, and releases are not delayed to wait for a feature to stabilize. The goal of the process is to provide regular improvements to users without disrupting longer-term work," writes Sayre.
Sayre also says that silent updating -- automatically delivering updates in the background -- will be necessary in order to make the faster release schedule work. Mozilla had tried to include silent-update capability in Firefox 4 but ended up stripping it out, as it needed more work.
This story, "Mozilla: A new Firefox every 16 weeks," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.



 source:http://www.infoworld.com/t/web-browsers/mozilla-new-firefox-every-16-weeks-005

Experts see wide use of flash-hard disk hybrids by 2016

Hybrid drives will keep costs down while approaching solid-state drive performance, two storage experts said

By Ralph Jennings | IDG News Service

A quarter of new laptops and half of new desktop PCs will adopt an emerging data storage method by 2016, pairing flash memory with traditional hard disk drives (HDDs) for better overall performance, according to two storage experts.
Flash paired with HDDs will also cost users less than rival solid-state drives (SSDs), they said.
[ Also on InfoWorld: SSD data transfer speed doubled. | Managing backup infrastructure right is not so simple. InfoWorld's expert contributors show you how to get it right in this "Backup Infrastructure Deep Dive" PDF guide. ]
Although the quieter, faster, more shock-absorbent SSDs are replacing HDDs in new computers, their relatively high cost will keep HDDs in most PCs over the years ahead, said Tom Coughlin, president of Coughlin Associates, and Jim Handy, an analyst with Objective Analysis.
The analysts predict 53 percent of PCs and 25 percent of laptops will have paired flash and HDDs by 2016.
NAND flash memory, the main storage chips inside iPhones, iPads and SSDs, can offer a welcome layer of caching and buffering between HDDs and higher-performance DRAM memory, Coughlin and Handy explained in a report published by the Storage Networking Industry Association, a group of 400 member companies.
The use of flash will become more critical because of a growing "performance gap" between DRAM and rotating storage such as hard disk drives, they said.
Extra caching would take pressure off the hard disk drive to provide temporary data storage. The pairing could also cut system power consumption.
"Rather than displacing HDDs, flash memory will allow customers to keep their low-cost HDD storage while enjoying performance enhancements that approach those of a pure SSD-based computer," the report said. "The required modicum of flash memory will be inexpensive enough to afford users these benefits without requiring a significant price premium."
"Paired Storage," a name given by the association to the flash chip-HDD scheme, is already being used in data centers and high performance computing operations.
Several approaches are in use today, including hybrid HDDs and flash on the computer motherboard. Only Seagate makes hybrid hard disk drives now, but the analysts expect most HDD makers to follow soon.
They also predict the innovation will bring about a new kind of tablet, the hottest consumer product of the year. The new device, the "fat tablet" will combine flash memory with hard disk drives as today's tablets lack power to give businesses and other users what they need, the analysts said. Forty percent of the total tablet market will be "fat" by 2016, the two U.S.-based experts forecast.
Flash technology for its part is improving. Earlier this month a flash working group announced a new interface specification that could accelerate data transfers from storage products such as SSDs.




source:http://www.infoworld.com/d/data-center/experts-see-wide-use-flash-hard-disk-hybrids-2016-946

EMC: RSA SecurID info swiped via sophisticated hack attack

Company exec warns customers that stolen information could be used to more easily penetrate customers' systems

By Ted Samson | InfoWorld

 

 

EMC issued a warning today that hackers have stolen information about its RSA SecurID two-factor authentication that could be used by cybercriminals to more easily breach customers' systems.
In an open letter, RSA executive chairman Art Coviello revealed that the information was stolen via an APT (advanced persistent threat) attack. "While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, [it] could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," he wrote.
[ Master your security with InfoWorld's interactive Security iGuide. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]
RSA is a subsidiary of EMC; its SecurID system allows admins to configure, assign, and manage token-based authentication from a central site.
According to Coviello, RSA has found no signs that the hackers made off with any customer- or employee-specific data or any information about other RSA or EMC products.
The company is providing steps for customer to take to strengthen their SecurID implementations, according to Coviello; additionally, RSA and EMC are offering customers access to internal resources and to partners to help address the situation.
Further, the company is urging customers to follow steps outlined in a SecurCare Online Note. Notably, at the time of writing, RSA's SecurCare Online website was "experiencing issues [that] may prevent your registration from processing correctly."
This article, "EMC: RSA SecurID info swiped via sophisticated hack attack," was originally published at InfoWorld.com. Follow the latest developments in business technology news and get a digest of the key stories each day in the InfoWorld Daily newsletter. For the latest developments in business technology news, follow InfoWorld.com on Twitter.
InfoWorld Senior Analyst Ted Samson covers a broad array of topics pertaining to information technology and is a frequent contributor to the InfoWorld Tech Watch blog. Follow him on Twitter at tsamson_IW.

source:http://www.infoworld.com/d/security/emc-rsa-securid-info-swiped-sophisticated-hack-attack-917

Executive Support System

Executive Support System (ESS) is a reporting tool (software) that allows you to turn your organization's data into useful summarized reports. These reports are generally used by executive level managers for quick access to reports coming from all company levels and departments such as billing, cost accounting , staffing, scheduling, and more.

In addition to providing quick access to organized data from departments, some Executive Support System tools also provide analysis tools that predicts a series of performance outcomes over time using the input data. This type of ESS is useful to executives as it provides possible outcomes and quick reference to statistics and numbers needed for decision-making.

The exact reporting tools and outcome of an Executive Support System completely depends on the ESS developer and it's intended industry use. For example, Cambridge Systematics has ESS to support the investment planning process for the Ministry of Transportation. The features and functions of this Executive Support System are entirely different from the Executive Support System developed by Meditech, which is useful to health care organizations.

Several companies offer pre-designed Executive Support System packages (usually suited to one particular industry), while others offer packages which can be customized your your organization's needs.



Reference: http://www.webopedia.com/TERM/E/Executive_Support_System.html

What is decision support system

Abbreviated DSS, the term refers to an interactive computerized system that gathers and presents data from a wide range of sources, typically for business purposes. DSS applications are systems and subsystems that help people make decisions based on data that is culled from a wide range of sources.

For example: a national on-line book seller wants to begin selling its products internationally but first needs to determine if that will be a wise business decision. The vendor can use a DSS to gather information from its own resources (using a tool such as OLAP) to determine if the company has the ability or potential ability to expand its business and also from external resources, such as industry data, to determine if there is indeed a demand to meet. The DSS will collect and analyze the data and then present it in a way that can be interpreted by humans. Some decision support systems come very close to acting as artificial intelligence agents.

DSS applications are not single information resources, such as a database or a program that graphically represents sales figures, but the combination of integrated resources working together.



Reference: http://www.webopedia.com/TERM/D/decision_support_system.html

MIS

Short for management information system or management information services, and pronounced as separate letters, MIS refers broadly to a computer-based system that provides managers with the tools for organizing, evaluating and efficiently running their departments. In order to provide past, present and prediction information, an MIS can include software that helps in decision making, data resources such as databases, the hardware resources of a system, decision support systems, people management and project management applications, and any computerized processes that enable the department to run efficiently.

Within companies and large organizations, the department responsible for computer systems is sometimes called the MIS department. Other names for MIS include IS (Information Services) and IT (Information Technology).




Reference: http://www.webopedia.com/TERM/M/MIS.html

Transaction Processing System

A transaction processing system is a type of information system. TPSs collect, store, modify, and retrieve the transactions of an organization. 

A transaction is an event that generates or modifies data that is eventually stored in an information system. To be considered a transaction processing system the computer must pass the ACID test.

The essence of a transaction program is that it manages data that must be left in a consistent state. E.g. if an electronic payment is made, the amount must be both withdrawn from one account and added to the other; it cannot complete only one of those steps. Either both must occur, or neither.

In case of a failure preventing transaction completion, the partially executed transaction must be 'rolled back' by the TPS. While this type of integrity must be provided also for batch transaction processing, it is particularly important for online processing: if e.g. an airline seat reservation system is accessed by multiple operators, after an empty seat inquiry, the seat reservation data must be locked until the reservation is made, otherwise another user may get the impression a seat is still free while it is actually being booked at the time. Without proper transaction monitoring, double bookings may occur.

Other transaction monitor functions include deadlock detection and resolution (deadlocks may be inevitable in certain cases of cross-dependence on data), and transaction logging (in 'journals') for 'forward recovery' in case of massive failures.



Reference: http://en.wikipedia.org/wiki/Transaction_processing_system

New attacks leverage unpatched IE flaw, Microsoft warns

The bug was disclosed in January, but it's now being used in targeted attacks

By Robert McMillan

March 12, 2011 01:32 AM ET

 

IDG News Service - An Internet Explorer flaw made public two months ago is now being used in online attacks.

The flaw, which has not yet been patched, has been used in "limited, targeted attacks," Microsoft said Friday in an update to its security advisory on the issue.
Google concurred, and offered a few more details. "We've noticed some highly targeted and apparently politically motivated attacks against our users," Google said in blog post. "We believe activists may have been a specific target. We've also seen attacks against users of another popular social site."
The attack is triggered when the victim is tricked into visiting a maliciously encoded Web page -- what's known as a Web drive-by attack. It gives the attacker a way of hijacking the victims browser and accessing Web applications without authorization.
The flaw lies in the Windows MHTML (Mime HTML) parsing software used by Internet Explorer, and affects all currently supported versions of Windows. It was disclosed on the Full Disclosure mailing list in January.
Microsoft has released a Fixit tool that users can download to repair the problem, but has not said when, or even if, it plans to push out a comprehensive security update to all users.
Google isn't saying who exactly was targeted in this latest incident, but Chinese activist groups have been the focus of cyber attacks in the past. This may be another example of an ongoing and methodical effort to track and steal information from pro-democracy and Tibetan activists.
Now that the flaw is being exploited in attacks, the pressure is mounting on Microsoft to produce a reliable patch for the issue that can be pushed out to hundreds of millions of customers.
"For now, we recommend concerned users and corporations seriously consider deploying Microsoft's temporary Fixit to block this attack until an official patch is available," Google said.

source:http://www.computerworld.com/s/article/9214259/New_attacks_leverage_unpatched_IE_flaw_Microsoft_warns
 

Window Defender

Ish!!!! Why my laptop always appears a statement about update window defender….I felt impatient..… what is the window defender actually?? Is it important to our system??

Windows Defender is software that helps protect your computer against pop-ups, slow performance, and security threats caused by spyware.

Benefit  of Window Defender:

Improved Internet browsing safety

• Windows Defender helps stop spyware before it infiltrates your computer. Windows Defender also offers a continuous safeguard designed to target all the ways that spyware can infiltrate your computer.

Protection against the latest threats

• To help protect your computer from the latest threats, you can choose to have updates that counteract new spyware automatically downloaded to your computer.

Is the window defender important??

In my opinion, Windows Defender detects and removes known spyware only. It cannot to give full protect  to our system. For example, it cannot protect from malicious software(viruses, trojan horses, and worms). So I think it is not really important to our system and it can be replace by other antivirus. Such as Norton Antivirus, Kapersky Anti-Virus, ZoneAlarm Anti-virus, Shield Deluxe and more. All of these anti-virus can protect from spyware, malware and more.

In a conclusion, it is better to have a good anti-virus than window defender!!!

                                                               

                        

Kaspersky Internet Security 2011 Wins Top Marks for Treating Malware in AV-Test's Q4 2010 Report

Kaspersky Lab, a leading manufacturer of secure content and threat management solutions, announces that Kaspersky Internet Security 2011 has earned a top award in tests performed in the fourth quarter of 2010 by AV-Test.org, an authoritative German research center. Kaspersky Internet Security 2011 was the only solution to earn top marks for successfully treating infected computers during the test.
Twenty-three popular antivirus solutions were tested in order to determine the level of protection they offer against malicious programs, their usability and their ability to restore infected machines to working condition. During protection testing, the programs' levels of static and dynamic detection was evaluated, i.e. the capability of each solution to detect threats with and without executing the suspect code. During restoration testing, the competing solutions were assessed for their ability to neutralize malicious programs introduced onto the test machines prior to each security product being launched. During usability testing, the security products were tested for their ability to operate without producing false positives or making a noticeable impact on the test computer's performance. All solutions used their default settings on computers running 32-bit Microsoft Windows Vista SP2.
Kaspersky Internet Security 2011 achieved top scores in all of the tests and received a prestigious award certificate from AV-Test.org. The solution's security performance was the best of all the solutions tested, with an exemplary 5.5 points, and was the only solution to earn a straight 6 points out of 6 for restoring previously infected machines.
Kaspersky Internet Security 2011 far exceeded the average performance of the tested products in all aspects of malware treatment, including deleting active and inactive malware components, eliminating unwanted modifications to the system and detecting and deleting hidden rootkits and other dangerous programs.
"The malicious programs that penetrate a user's computer can change the system settings or make changes to various files," says Nikita Shvetsov, Director of Malware Research at Kaspersky Lab. "Aside from deleting the malicious programs it detects, a security solution must also repair modified files and disk system areas. Kaspersky Internet Security 2011 perfectly handles these important tasks, as this test has clearly demonstrated." For details of the testing performed by AV-Test.org, please visit: http://www.av-test.org/certifications

16 Feb 2011 

source:http://www.kaspersky.com/news?id=207576274

A short story about Microsoft Word 2010 Part

Today, i would like to recommand the function of setting a budgets on Microsoft Word 2010. Before i describing the steps, i would like to add some point about the benefit of setting a budgets. Firstly, a good budgets can helps us to save money. As we know, as the increasing of standard living, the cost of living also increased, so to be survive in this situation, a good budgets planning a required. Secondly, good budgets also can control our expenses. This because the budgets setting as the guideline when we expenses on something, so we did not spend our money on unimportant things. Here, i would like to describe the steps taken on setting budgets through Microsoft Word.
    Step 1: Download the form of budgets on Microsoft Word, which located the page of new templates
    Step 2: The form you download will display at the word as shown at the figure below

    Step 3: Fill in your expenses on each category and summarizes it
    Step 4: Finally, your upcoming budgets will display and printing is needed if you want to keep the expenses on track

*Good budgets is depend on good planning, so plan before you expense.

Malware in February: Cybercriminals Perfect Drive-By Tactics

03 Mar 2011

Kaspersky Lab’s latest monthly report on malware activity highlights the current popularity of using drive-by attacks to infect users’ computers. These attacks are particularly dangerous because they take place without the user’s knowledge and can be initiated from legitimate websites that have been hacked by cybercriminals. Visitors to infected sites are redirected to web pages containing script downloaders. Various types of exploits that launch script downloaders are quite often used to download malware to users’ computers.
In February, the majority of drive-by attacks made use of Cascading Style Sheets (CSS) to store some of the data for script downloaders. This new, enhanced method makes it much harder for many antivirus solutions to detect malicious scripts and allows cybercriminals to download exploits without them being detected.
Three entries in the Top 20 most malicious programs detected on the Internet in February corresponded to pages containing CSS data and a malicious script downloader. One of them claimed 1st place, while the others came in at 13th and 19th places. The script downloaders on these malicious web pages download two types of exploits. One of them, which targets the CVE-2010-1885 vulnerability in Microsoft Windows Help and Support Center, took 4th place in the same top 20 ranking. On average it was detected on approximately 10 thousand unique computers every day. The second type of exploit uses vulnerability CVE-2010-0840 in Java Virtual Machine and accounted for three entries (3rd, 7th and 9th places) in the rating of Internet-borne threats.
February showed that there are still potentially dangerous PDF vulnerabilities out there. The number of unique computers on which PDF exploits were detected exceeded 58 thousand in February. One such PDF exploit entered the Top 20 malicious programs on the Internet in 8th place.
A malicious packer that is used to help protect the Palevo P2P worm was detected on more than 67 thousand unique computers throughout the month. This worm was responsible for the creation of the Mariposa botnet that was shut down by Spanish police a while ago. It seems likely that the recent spread of this packed worm is linked to an attempt by cybercriminals to create a new botnet or restore the old one.
February saw the discovery of a number of new malicious programs for the Android platform. Malware for the J2ME platform was also popular among cybercriminals, with Trojan-SMS.J2ME.Agent.cd, for example, entering the Top 20 most widespread malicious programs on the Internet at 18th place. Its main function is to send SMSs to premium-rate numbers.
More detailed information about the IT threats detected by Kaspersky Lab on the Internet and on users' computers in February 2011 is available at: http://www.securelist.com/en/analysis/204792166/Monthly_Malware_Statistics_February_2011

source:http://www.kaspersky.com/news?id=207576288

A short story about Microsoft Word 2010 Part 3

Today, I would like to introduce about publishing a new post by Microsoft Word. The step are simply and easy, that is
    Step 1 : Same as the calendar templates, you need go to the page templates and click on the "Blog Post"
    Step 2 : After that, you will move to a new page and ask to register your blog account
    Step 3 : After registration, you can type you post in the word as shown in figure

    Step 4 : Click the button publish at the left-hand side
    Step 5 : Your blog are successful publishing.


*The post are publish by Microsoft Word 2010

A short story about Microsoft Word 2010 Part 2

Did you face problem when you want to do citation on the text you took from web or on the book? Here, the Microsoft Word 2010 had offered the function to help the students making the citation. Here is the step on marking the citation
Step 1 : At the command bar, you select the "References" option
Step 2 : At the  "References" option, you click the "Mark Citation" on right-hand side
Step 3 : A toolbox will be pop up as shown in the figure

Step 4 : Type your text or highlight your texts into "Selected texts" box and then key in your key term you want to citated into "Short citations" box 

Step 5 : Mark all you item that you already citation and finally type your references in the endnote of the article

*Hopefully this informaton can help us to produce more effective words

A short story about Microsoft Word 2010 Part 1

As the Microsoft Office 2010 are introduced by the Microsoft Corporation in the year 2010, the are many new features are install in the Microsoft Word, such as the file extension, templates and so on. Now, i would like to share about the new form of template that are provided by Microsoft Word, that is calendar. Today, many work are needed to scheduling, so Microsoft Corporation offer a easy step to us to set up the time table according the date. Now, i would like to show the step that how download the templates and how to use it.
Step 1 : Open the Microsoft Word, and at the command bar click the "File" button as shown in Figure

Step 2 : Select "new" button and click on the calendar template

Step 3 : Select the calendar you want and then click download on the right hand side

Step 4 : Finally you can scheduling you work on the Microsoft Word

*P.S : You need to online when download the calendar templates



Find trojan horse virus on PC

Q&A: What is DRM?

EMI has announced that it will be offering its back catalogue online without software locks, called digital rights management. The songs will be sold at a higher price to those currently with the digital locks but will also be at double the audio quality.




What is DRM?
Digital Rights Management, or DRM, is a class of technologies that allow rights owners to set and enforce terms by which people use their intellectual property.

Rights owners are typically copyright-holding companies like music, film, book or software publishers. They use DRM to control how documents, entire software programs, or even e-mails are used.

Most often media companies use DRM to curb piracy of their content by restricting users' ability to copy it, though it can also be used to create new business models like subscriptions to a large library of music.


How does DRM work?
DRM is a two-part scheme. It relies on encryption to protect the content itself and authentication systems to ensure that only authorised users can unlock the files.

When applied, DRM scrambles the data in a file rendering it unreadable to anyone without the appropriate unlocking key.

Authentication systems stand between users and the decryption keys, ensuring that only people with the proper permissions can obtain a decryption key.

Without a username and password or if a file has been decrypted too many times, the system will not provide the key. This means music files with DRM, for example, can be swapped over the internet and remain unusable to those who have not paid for them.

It also means only authorised programs and portable players can use the tracks.

Music without DRM, like the popular MP3 music format, retain the ability to be played regardless of the number of times or to whom they have been copied.



Who is using DRM and why?
The most common commercial use of DRM is copy prevention. The technology gives rights holders some assurance that their intellectual property will not be pirated, and helped to create a legal digital download industry.

Film studios were some of the first large companies to adopt DRM.

When the DVD format was launched it included an encryption scheme called the Content Scrambling System, which prevented users from making digital copies of films off the disc.

Recording labels have also adopted DRM to prevent copying.

With the advent of peer-to-peer file sharing networks and the MP3 music compression format in addition to the proliferation of broadband internet access, they claimed music piracy drastically increased.

CD publishers reacted by making discs in a way that lets them play in a regular machine, but not in a computer. This prevents users from copying the music and distributing it over the internet.

Many record labels have also released DRM-protected music for sale and download in online stores like Apple's iTunes and Roxio's Napster. These tracks can play on a set number of computers and portable devices.

DRM video downloads are just beginning in the UK. Channel 4 and Sky have on-demand services that include films.


What are the problems with DRM?
Some consumer groups and internet commentators vociferously argue against the use of DRM.

One of the most often cited problems with the technology is that competing systems are not compatible. For example, users of the Napster service cannot play a track on the iPod.

Changing music download providers or portable players could mean already purchased tracks are unusable.

Because tracks have to be authenticated to play, they may also become unusable if a download company goes out-of-business.

Both cases force purchasers to either forfeit their music or re-purchase it, and for this reason has been characterised as anti-competitive.

Unlike brick-and-mortar shops selling records, cassettes, or CDs, digital download companies can lock consumers into their service.

Critics also argue that many DRM systems go far beyond the rights the law gives rights holders to protect what they create.

DRM is also an imperfect technology. Hackers and software companies engage in a constant back-and-forth battle where any given system is broken, patched, and broken again.

DVD copy prevention was cracked in part by the then 15-year-old Jon Lech Johansen.

Still others object to DRM on philosophical grounds. Art, they contend, is often a collaborative process that builds off the work of others.

For digital media, this is referred to as the "rip, mix, burn" culture.

As music, film, and literature is increasingly expressed in digital form, many worry that restrictions on the use of this content will limit creativity.



Source: http://news.bbc.co.uk/2/hi/technology/6337781.stm

10 Tips for Creating Secure Passwords

If you do anything with computers, you deal with passwords and you probably have a handful of different passwords for different sites and systems. The best password is something that you will never forget, but even your family or closest friend would never guess.

In my experience people either have extremely secure passwords like J!*xurQ1# that are so difficult to remember that they have to write them down (which defeats the security of a password) or extremely unsecure to start with, like Jonny (the name of their spouse). The goal of this post is to give you some ideas on how to generate secure passwords. The tips start out with some simple ways to come up with terms and end with ideas of how to combine these terms into secure passwords.

It should be obvious that you shouldn’t directly use any of the examples shown here. However, some of these ideas should be useful in generating your own secure passwords.

Here are a collection of tips for creating useful passwords.

1. Use Different Character Classes - Many systems require that your password be from a variety of character classes. The letters a to z are one character class, A to Z is another, 0 to 9 is another, and the symbols are a fourth. In general the more character classes you use in your password, the more secure it is. So “guitar” is less secure than GuiTar which is less secure than Gu1T&r. One simple way to add different character classes is to capitalize all vowels or consonants.

2. Use Letters from a Phrase – Use the first letter from each word in a phrase, line from a song, etc. “There’s a hole in the bottom of the sea.” could become Tahitbots.

3. Numbers From Word - Use your phone keypad to convert a word to its numerical equivalent to use as part of your password.

4. Keyboard Patterns – Creating terms from rows of adjacent keys. 12345 is not very good, but \][po combined in the ways specified below can make for a secure password that would be very difficult to guess and is fast to type.

5. Use More Than One Word - Single word passwords are easy to break. If a hacker runs a program to try a bunch of words from the dictionary they shouldn’t be able to figure out your password. Choose words that you will remember, but that someone else won’t be able to guess. So a password like shinynail or flyingrock or tallwater are more secure than single word passwords.

6. Ideas for Passwords – Sometimes coming up with a password can be pretty difficult. Keep in mind you need to choose terms that you won’t often talk about. Here are a list of ideas to help come up with words:
* Choose two objects from a picture that you’ll always remember. For example: a drawing at your grandparents house, the illustration from a children’s book, a painting at an art museum, etc.
* Choose two terms from a memorable purchase. For example: bluev6 (first car), thinibm (first computer), gold3crt (engagement ring), 7ftgrand (piano), pinedoor (first house), sunshore (honeymoon destination).
* Look through a catalog and choose terms based on something you see.
* Look up a random article on Wikipedia and choose a word found or related to a word you find in the article.

7. Separate Your Two Words With Symbols and Numbers- For example: pine&1&door, kit!2!cat, etc.

8. Modify the Password For Each Site- In theory, the most secure password strategy is to use a completely different password for each system. In practice, this means you’ll have to write them down. By choosing a secure password and modifying it based on where it will be used, you can keep from having to write passwords down, but still have a slightly higher level of security. Here are some examples showing how they were created
* blue.Mv6 for Amazon.com – blue and v6 from first car. M from the second letter in site name.
* blue.Av6 for SAP logon – same as above.
* thin!5!ibm for Amazon.com – thin and ibm from first computer. 5 from the number of letters in the site name.

9. Multiple Passwords for Different Types of Sites – Another option to keep from using the same password on every site is to use two or three passwords based on how secure the site is. For example, your banking sites might all use derivations of the bluev6 password. Ecommerce sites might all use a derivation of a different password and community type sites might use a third. The goal is to make sure that a rogue administrator at a forum you frequent isn’t able to get to your 401k.

10. Date Based Component – Some systems require you to change your password every 180, 90, or 60 days. (One client had set up their system to require a password change every 30 days!) If you are familiar with the cycle, you can add a date based component to your password and change it each time it is required. For example J10 could be added when you need to change your password in June of 2010.



Source: http://www.productivity501.com/10-tips-for-creating-secure-passwords/253/

Computer Virus

Different Kinds of Biometric Devices

Personal identification methods have been advancing through the study of biometrics. As technology progresses, inexpensive, user-friendly identification techniques are becoming the norm. Permanent identification applications are being relied upon for business and private use which focus on distinguishable traits that cannot be lost or stolen. Networks that communicate and share single-person identification data are being developed, eliminating the need for passwords and decreasing the problem of identity theft.

Fingerprint and Hand Scanners

Fingerprint scanning eliminates the need for multiple passwords.

Biometric fingerprint scanners capture and process a person's fingerprints. Each person's fingerprints are unique and can only be used to identify that person. Fingerprint scanners allow a person to imprint their fingerprint into a device that stores and is able to compare it against other fingerprints. Fingerprinting technology has advanced allowing fingerprint scanners to be installed in laptop computers, at ATMs, in real estate lockboxes, as employee recognition in schools and businesses and for national security purposes.

Hand scanners are similar to fingerprint scanners except they authenticate features of the complete hand, measuring lengths and thickness of fingers, curves and bone structures of fingers and surface area of palms. Because many hand traits can be disturbed by injury, hand scanning is often used with other types of biometric identification.

Facial Recognition Cameras

Cameras are used in facial recognition biometrics.

Cameras are used in biometric facial recognition technology. Main features of the face are captured, while expressions, piercings and facial hair like beards and mustaches are not. Infrared cameras are used to detect heat patterns in the face. Some facial recognition devices incorporate several cameras to capture more detail and reduce light interference. Facial recognition is not reliable for identifying people through photographs and cannot identify people wearing masks.

Voice Recognition Microphones

Microphones record unique voice characteristics.

Microphones tape the acoustics and inflections in a person's voice. Voices are distinguished by physical shape and build of the mouth and throat, age and learned behavior related to culture, tone, pitch and volume. Voice recognition software usually uses a password to digitize a person's voice, filtering out unique characteristics. It is used for security purposes and has also become an invaluable tool for physically disabled people, making it easier for them to use computers and function in society.

Iris Scanners

Portable iris scanners detect distinguishable traits in eyes.

Iris scanners detect individual traits of a person's eye. They are often portable devices used mainly to track people. Recent software developments have been improved so that iris detection works when a person is wearing contacts or glasses. Prison guards use iris scanners to track prisoners, strengthening security and monitoring inmate arrivals and departures.

Signature Pads

Computerized signatures protect against forgery and identity theft.

Signature pads are becoming commonplace in retail outlets. They capture and process a person's signature. These biometric devices perform handwriting analysis, pauses during writing, rate of speed used when writing and pressure applied when writing. Advancements in signature pad technology limit forgery of documents, lessening the chances of identity theft. Signature pads are used with increasing frequency in Internet business.




Source:http://www.ehow.com/list_6652449_different-kinds-biometric-devices.html