GhostSurf 6
Transcription
GhostSurf 6
ISSN 1061-5725 This Month’s Presentation Microsoft Visual Studio and Expression Studio Where did the programming go? Volume 29, No. 5 May 2011 www.ucs.org This Month’s Meeting: Wednesday 11th at 7 pm Check Out Review GhostSurf 6 & Security Related Report #20 The drudgery of programming is severely reduced This is not a programming presentation It is about design! Starting on on page 4 Utah’s Award Winning Computer Magazine! ™ By Cliff Millward, Editor [email protected] Just “Mousing” Around About ten years ago while attending COMDEX (remember COMDEX?) I came across a lovely unusual item, a mouse pad that looked like a Persian rug. I did not buy it then but decided to buy it a day or so later. Needless to say I never got around to buying it as I could not remember at what booth I saw it. I have always wanted one ever since that time. I suddenly had an inspiration; maybe if I type mouse pad rugs in Google something will come up. Walla -- it did! In fact Google brought up several manufacturers web sites. They are rather expensive, but I just had to have one. I am very tempted to order one even though they are very expensive. However, after all is said and done, as Don Nendell says, “happiness is a working computer.” Stay tuned. Maybe next month I will be singing the praises of an Apple Computer! (Never thought it would happen.) Recent Tech Events My mouse now slides in comfort over a replica of a Persian rug. Fun, fun, fun. If you want to see what they look like, I recommend mouserug.com and enjoy. The “Dark Side” Warning, I am contemplating going over to the “Dark Side!” I am still having trouble with Windows 7. I was on the phone with Microsoft (India?) for three and a half hours a few days ago trying to straighten out some of the problems I was having. I finally got Windows to run on my new SSD drive, but it still (sometimes) does not want to load correctly. I have run three different virus checkers to look for malicious software, but all of them say I am clean, so it must be some conflict with the programs I am using. My son, Ryan, who troubleshoots computers at the University of Utah cannot seem to eliminate the problem either. (By the way, I have AMD and an Intel computers and Windows 7 balks on both of them so it is not the processor.) All of a sudden I receive an e-mail form Apple which announces the availability of a new powerful 27 inch screen computer with incredible graphics. (Droll, droll) Apple Most Valuable Apple overtook search-engine giant Google to become the world’s most valuable brand, according to a company in Boston named Millward Brown. I know nothing about this company and I don’t believe I have any long lost relatives there (although my grandfather said one of his brothers settled in Boston. ) Apple’s value climbed in the past year to $153.3 billion. A spokesman for Millward Brown said. “Google’s brand lost 2 percent to $111.5 billion, ending four years atop the rankings, while International Business Machines Corp. climbed 17 percent to be the No. 3, ahead of McDonald’s Corp.” Firefox is on Fire! Recently Firefox 4 downloads are outpacing Internet Explorer 9 downloads. This is despite the fact that Microsoft has started pushing the new browser via Windows Update. It appears that Internet Explorer 9 will never catch up to Firefox in the foreseeable future. Microsoft will have to be satisfied to be number three in terms of usage among the modern browsers.” The reason for this is very clear. Internet Explorer 9 only runs on Windows Vista and 7, while Firefox runs on Windows XP, Vista and 7, along with Mac OS and Linux. Still, this is quite an impressive achievement for Firefox. Finè Page 2 Blue Chips Magazine — May 2011 Blue Chips Magazine “Utah’s Award Winning Publication” Magazine Staff Editor — Cliff Millward Review Program Liaison — James Alexander Review Product Editor — Donna Nendell Review Editor/Product Recruiter — Don Nendell Photography — LeRoy Johnson Proof Reader — Larry Lamph, Doug Jackson Advertising Rates Ad costs 2 Page Spread Full Page Half Page Quarter Page Business Card 1 month $150 $100 $50 $25 $15 3 months $400 $275 $130 $70 $30 Charter Member of the Association of PC User Groups 619-9633 250-2269 (702) 776-8677 (702) 776-8677 6 months $700 $500 $250 $130 $60 12 months $1200 $900 $450 $225 $120 Full page size is 7½ x 10 inches. All other page sizes are based on a 7 x 10 inch page in order to conform to editorial style. Half-page ads may be 7 x 5 inches or 3½ x 10 inches. Quarter-page ads are 3½ x 5 inches. Business card ads are 3½ x 2½ inches. Classified Advertising Utah Blue Chips members may place personal classified ads at no charge. Maximum ad size is 7 lines, 35 characters per line. Submissions Members are encouraged to submit text articles for publication in ASCII text only. Photos in .TIF or .JPG format only. Line graphics, tables, in almost any vector or .TIF format. Do not imbed graphics or tables in text files. All articles must be received by the 15th of the month preceding the month of publication. All articles become the property of the Utah Computer Society and by submitting an article, the author gives permission for the Blue Chips Magazine Staff to edit the submission. The author also gives permission for republication in other users groups’ communications. Permission to Copy Permission is granted to other nonprofit PC user groups to reproduce any article published in this newsletter, provided credit is given Blue Chips Magazine and the author (s) of the reproduced materials. Reprinted articles are subject to the terms of their respective copyright holders. Officers and Trustees Eve. Phone E-mail President, Stuart Gygi V. Pres., Larry Lamph Secretary, Lowell Kenedy Treasurer, John Witzel Doug Jackson 576-1891 571-2908 278-3035 296-1390 322-2337 [email protected] [email protected] lkenedy@ucs,org witzelj@ucs,orgtt [email protected] Information Persons or companies may join or renew at the meeting, or by sending a check payable to the Utah Computer Society to: Utah Computer Society Membership Secretary 5435 Riley Lane Murray, Utah 84107 Individual memberships are $25/year. Business Memberships are $35.00 a year. Corporate sponsorships are available at two levels. Corporate Sponsors enjoy all benefits of membership including multiple individual membership and prepaid advertising coverage. Contact a Board Member for more information. Other important information: Meeting Information Group Business (James Alexander) Magazine (Cliff Millward) Web Site WebMaster Membership (evenings) (Bob) MONTHLY MEETING LOCATION 2nd Wednesday of every month May Renewals Bob Beaudoin Johnnie G. Duran Larry W. Hirschi Jerl Rich University of Utah, Union Building, 7:00 p.m. Page 3 Blue Chips Magazine — May 2011 http://www.ucs.org 250-2269 955-9633 http://www.ucs.org 262-6045 262-6045 Introduction to GhostSurf 6 Security-Related Report #20 By Don Nendell Dear Reader, If you are reading this in a non-PDF format, you are missing a large part of the whole Report/ Review 1 & 2. You should, therefore, stop reading and immediately follow the steps outlined in the Footnotes 1 & 2 below. Which BTW are: 1. “If you are reading this Report/ Review 1 & 2 from directly off of an Internet search, you are seeing it in HTML (or text) format. Yuk! There’s No Graphics there! To see all the beautiful Graphics in this Report/Review 1 &2 - the ones that we’ve worked so very hard to entertain you with -- you will need to follow the procedures outlined in 2 below. Enjoy! Again, our web page is: (www.ucs.org).” 2. “See the actual Reports/Reviews 1 & 2 in the Blue Chips Magazine (BCM) Archives (i.e., begin search on left-hand side of web page) at: (www.ucs.org). Note. Always choose the center option, i.e., PDF format for its beauty.” still eating your Nut & Honey cereal 5 and don’t even have a clue as to what is swirling dangerously around you/them that ultimately could have grave repercussions/ consequences for us all? I sometimes herein feel like a cel from the comic strip Mother Goose and Grimm; “Entertaining, but not serious!” (See Graphic). Folks, please don’t take all this lightly. It’s really deadly serious stuff! I’d much prefer to see you “Shake ‘n Bake!” (See Graph- down here in Sin Town. We start with a duzzie.... And, this definitely ain’t “Nut’n Honey? ic), than remain so naive about all this Security. With that feeble attempt at wry, or is it “rye” humor, let’s “get the show on the road,” as the saying goes Sony admits massive data breach, gamers’ accounts ransacked by John P. Mello, Jr. GSN Magazine, April 27, 2011. Sensitive information for some 75 million gamers on Sony’s PlayStation network has been pilfered by hackers, the company acknowledged on April 26. “We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network,” the entertainment giant informed the gamers at its PlayStation Knowledge Center. “Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, Play- Prolog 3 This month, as usual, it’s all about protecting one’s self, privacy, personal information and freedoms, and especially, financial well-being, plus how to guard against the invasion thereof through “anonymity.” I always have some trepidation on writing another SecurityRelated BCM Review/Report 1 & 2 (#20 3) (SR), this being my 105th, particularly so soon after my S-R in February 2011 (#19 3). Trouble is, I see Security-Related “Bad News” every day, and have for over 15 years now, and sad to say, most of you out there in La-La land (including some members of our own government evidently?) are Page 4 Blue Chips Magazine — May 2011 Station Network/Qriocity password and login, and handle/PSN online ID,” the company said. “It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/ Qriocity password security answers may have been obtained,” it continued. “If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained.” Anonymous Hacked Sony’s PlayStation Network! No They Didn’t! by Chloe Albanesius, May 6, 2011, PC Magazine, The debate over whether online activist group Anonymous was behind the Sony PlayStation hack continued Friday, with a group spokesman taking to the op-ed pages of The Guardian to deny any wrongdoing, while sources told the Financial Times that Anonymous members are probably behind the attack. Sony’s PlayStation Network has been offline since April 20 thanks to a sophisticated cyber attack. Earlier this week, Sony told members of Congress that one of its Sony Online Entertainment (SOE) servers contained a file called “Anonymous” with the words “We Are Legion,” the group’s tagline. In response, Anonymous said it has never engaged in credit card theft, and said that many of its corporate adversaries engage in activities far more ethically suspect than Anonymous. PlayStation breach a warning for Apple and YouTube by John Kennedy, Silcon Republic, April 28, 2011. It has already been termed one of the greatest security breaches in history, but will the Sony PlayStation network breach that has affected 77M users provide a salutary lesson to players like Apple and Amazon, who also hold millions of credit card details? Every time I download an app on my iPhone or iPad, for example, I’m asked for a password. That’s it [My added emphasis here]. The app is downloaded and is mine to enjoy in just seconds. However, behind the scenes and over the air and down the broadband pipes, at the end is a slick, serious engine at Apple that crunches the numbers, manages the transaction and green lights the download [plus, also tracks your iPhone GPS location for up to a year]. Few in the world realize it but Apple is one of the world’s largest repositories of credit card information. Every iPad, iPod and iPhone user must have a credit card in order to enjoy iTunes.... “Larry Ponemon, chairman and founder of the Ponemon Institute, said the theft could cost Sony more than $1.5 billion, or an average of $20 for each of the 77 million customers whose data was potentially compromised. Poneman’s firm specializes in securing information on computer networks.” (Reuter’s) “Cyber crime preys on the enterprise with a vengeance. Criminals work 24 hours a day, every day, and are getting more sophisticated despite our best enterprise defenses.” - Eric Friedberg, Co-President, Stroz Friedberg, The State of Cybercrime presentation at the CSO Executive Seminar Series on Cyber Security, March 16, 2011. Looking at the pathetic “number of views” of each of the “selectable(*) YouTube Videos on Cybercrime” (See Below) is actually as scary to me personally as what is actually happening in the Page 5 Blue Chips Magazine — May 2011 world of Cybercrime today. I feel like Chicken Little crying “The Sky is Falling!” No one listened to her either, but it’s still no less important to everyone. So, how did “they” get to Sony? Well, if you even care just a little about all this Security-Related Report stuff, at the very least look at a 4:00 minute, stunning Nov. 12, 2010 YouTube video entitled: State of Cybercrime: Cybercrime is on the rise, created by Brandon McFarland for ArcSight (See Below), one I personally watched, and was absolutely stunned by it at the just concluded, simply outstanding Symantec Vision 2011 Conference at the Caesar’s Palace. The very informative class that I viewed the video in was titled: Data Loss Prevention (DLP). Be sure and “Bookmark” this YouTube Video in your browser (merely to be used as a starting point only) and view this fascinating, educational video (plus other equally important Cyber Crime videos) at: (*) State of Cybercrime (ArcSight Video 112010) http://www.youtube.com/ watch?v=ZqxAk4tSBUM Websense 2010 Threat Report (111110) http://www.youtube. com/watch?v=M2oJxo23zc&feature=related Cartoon: Safeguarding Your Computer-Cyber Crime http://www.youtube.com/watch?v =MbBYIPOPcgk&feature=related The State of Cybercrime Jan 20, 2011 ... Cybercrime involving stolen credit card numbers, money laundering, botnets and other black-hat activities is a huge business online.” - mashable. com/2011/01/20/black-hat-hackingstats/ mous surfing,” so, borrowing from another TV commercial, like Nike says, let’s, “just do it!” or, better still, casting my net for one last piece of fishy humor, “just for the halibut?” Due to the magnanimous generosity of the talented and exceptionally knowledgeable professional Symantec presenters in sharing their Symantec Vision 2011 presentation slides with me, I’ve extracted some of the most pertinent Graphics from some of those PPT’s presented in the “Data Loss Prevention” series of classes. (See those Graphics on pages 15 through 19 for your edification and enlightenment.) Take it from one who has actually “been there, and done that,” if past history is to be our indicator, then, it seems to be a fact that the “collective, uncaring, naive, you” won’t give a “Tinker’s Damn,” or care “One Iota” about what is being said here, or elsewhere, for that matter, about the exploding threat of Cybercrime (i.e., Viruses, Trojans, ID Theft, Data Loss, et al.) until you are personally slapped hard in the face like I was, ex post facto 6 , with the reality that “You’ve Got Mail!” and it’s not just the good kind either. Know you full well that you all are simply the main ingredient i.e., “the mince meat,” in the cybercriminals “Mince Meat Pie” they’re cooking up for you, as we speak. They’ll be eating you for their dessert before you can clap your hands together, Just remember this: “you’ve been had,” um... sorry ‘bout that, “... warned!” There’s “oodles and gobs” of Security problems to report to you out there just crying to be heard, but we have an axe to grind herein, and it’s not too large of a leap of faith over to “anonymity and anony- Looking Back a Couple of Years Ago From my BCM S-R of January 2009, Introduction to GhostSurf Platinum Review 1 & 2 (page 4) I wrote: “After seeing the eWeek Magazine The Year in Review (December 15, 2008) issue, I got to thinking - strange as that may seem - that one ‘critical area’ of my previous ... BCM ‘Security-Related’ Reports and Reviews I haven’t covered to date is ‘Surfing the Internet Anonymously.’ What really brought this front and center, however, was an ‘unopened’ shrink-wrapped box of Ghost Surf Pro that, somehow, was just lying there on my side desk simply crying for me to open up, and ‘slip silently [pun definitely intended] into action?’ Page 6 Blue Chips Magazine — May 2011 “Sir Arthur Conan Doyle said, ‘There is nothing as deceptive as an obvious fact.’ With interest definitely piqued, I decided to find out how far Ghost Surf Pro was out of date; yikes vintage 2002. But, it says it works for XP, so all isn’t lost after all, I could still use it on my ‘main squeeze’ PC, that same malicious XP I keep yapping about (HIAWC) 4. “With a guilty conscious, I started right away checking out the lineage of Ghost Surf (~) revisions: ~Pro, ~2005, ~2006, ~2007, and ~Platinum. Pretty impressive! OK! I’m only four (4) versions out of date. Not really so bad, but certainly not all that good (See Graphic below.) “Then I started my deep Internet search on a subject that I am familiar with from having previously attended a goodly number of DEFCON’s and Black Hat Briefings, but had no experience using first-, second-, or even, off-hand. Whoa! This is actually turning out to be quite fascinating. I should have done all this way back in 2002 with Ghost Surf Pro. ‘But better late than never,’ I murmured under my breath. And, it most definitely deserves a Review all of its own. Game on!” Sliding in safely to 2nd base with a double off the wall We ease our way into the Windows Vista/7 environment this month with the direct descendant of GhostSurf 2006, the smaller brother of GhostSurf Platinum (please see my January 2009 BCM Review of the GhostSurf Platinum 1 & 2 ), GhostSurf 6. And now, we come to the only “Security-Related” stretch I’ll be making herein, and hereon, “For the happiest life, days should be rigorously planned, nights left open to chance.” - Mignon McLaughlin. Well, that may be true generally speaking, but, it most definitely is not true when it comes to this month’s Security-Related Report subject, which is: Anonymous Internet Surfing “Q. What do nude volleyball and the Web have in common? A. Both offer the same amount of privacy.” - Old Anonymizer.com Web Site Point of Historical Interest. The first Internet anonymizer was Anonymizer.com (See Note below and See Graphics on pages20 and 21), developed in 1997 by Lance Cottrell during studies towards a Ph.D. in Astrophysics at the University of California, San Diego. One can immediately understand why he did Page 7 Blue Chips Magazine — May 2011 it? Cottrell is a noted privacy advocate. Note. it is still in existence today, but for a $79.99/yr subscription rate (See Graphics on pages 20 and 21). All The Aspects of Anonymous Surfing (~) I’ve done this before but it bears repeating here: 1) What is ~?; 2) Why would you want to do ~?; 3) Who does ~?; 4) What is the cost of ~?; 5) How is ~ done?; 6) When is ~ done?; and 7) Where is ~ done? 1. What is ~? Definition from WiseGeek <www.wisegeek.com>: “Anonymous surfing allows you to wander the Internet without leaving any track of your computer’s IP (Internet Protocol) address. This is accomplished via a proxy service. “When surfing the Web from the privacy of your living room, den or office, it may seem as if your movements online are completely anonymous. Unfortunately, the opposite is true. Everywhere you go you can be tracked through your IP address. The IP is a numerical value that maps back to your ISP (Internet Service Provider) and ultimately to your specific computer. It is linked to your computer by assignment to your login username and password (See Graphics on pages 20 and 21). “When you request a website by clicking on a link or bookmark, your computer sends its IP address to the website along with the request for the page. The destination server answers by sending the requested page to your return address. Your computer receives the HTML data and the browser turns it into a Graphic page you can view. In this way, websites can keep track of every page you view by logging your requests along with your IP [address] [my emphasis here]. “Anonymous Surfing defeats this ability by using a go-between proxy that ‘stands’ between the surfer’s computer and the Web. This intermediate server, or proxy, handles all of your computers requests for you. Your requests go to the proxy, which relays them to the Web. The website sends the requested pages back to the proxy server, which then forwards them to your computer. Websites can only log the proxy’s IP address, not yours. It’s rather like having a valet run all of your errands for you, so that the valet’s face is the only familiar face on the Web. 2. Why would you want to do ~? There are many reasons why people use web anonymizing services to surf anonymously. They range all the way from: to maximize their privacy, to simple paranoia (protecting personal data), to hiding browsing activities from others (including parents, spouses, or even other organizations), and/or to bypass web blocking applications that would prevent access to Web sites or parts of sites that the user wants to visit. However, (See more on Hacking and Trojans in the current issue (#73) of EyeSpy Magazine) it seems that those web anonymizing services have flaws that allow web sites to bypass those anonymizers and retrieve information about the user’s system (See vulnerabilities below). By surfing the Web you are exposed to hackers, bombarded by advertisements and subjected to spyware, malware, malicious Bots, and virtually anything conceivable [See Symantec Visions 2011 Above and See Graphics on pages 15 through 19]? Everything you do and download online can be watched. Hackers, Webmasters, any other users of your computer, and even your boss can see your Page 8 Blue Chips Magazine — May 2011 surfing habits. Worst of all, you make your personal and credit card information readily available, which can easily lead to Identity (ID) theft, amongst other chilling thoughts. It’s mostly all about Money, you know? It’s called cybercrime [See Symantec Visions 2011 Above and See Graphics on pages 15 through 19. Note. I’ll be reporting on KJB Security Products in the very near future. I met them (and a competitor of theirs) on the exhibit floor of ISC West recently. They sell “Spy Equipment” wholesale to John Q. public, as if we didn’t already have enough to worry about in our privacy, Eh? Anonymity, anyone? Bottom line. The obvious purpose to anonymously surf the web is for your own personal privacy, security, and peace of mind. Take a look at what I found out about my own PC before I started all this research, and that’s not all either. (See Graphic plus, now go back to the Ghost Surf Platinum Graphic from Salt Lake City and look at the bottom of the Graphic. Surprise!) FYI Do this for yourself, too! You can see some of the wide range of data that web sites can read from your own browser, as well, including your IP address and other identifying information, at the following sites: IP Info <http:// www.lawrencegoetz.com/programs/ ipinfo/>; Network-Tools.com <http:// network-tools.com/analyze/>; and, 404 Research Lab Supersleuth <http:// www.plinko.net/404/supersleuth.asp>. This is pretty scary stuff, folks! 3. Who does ~? Gizmo’s Allan Marillier at <www.techsupportalert. com/best-free-anonymous-surfingservice.htm> says, “The most obvious anonymous browsing application for most people is in internet cafes, on public terminals, using wireless or even wired access points away from home, or in fact, on any PC including your own, where you don’t want to leave traces of your private surfing activities. Some other browsing activity cleaners exist that clear the cache, cookies, history and other traces, [and] some are even available as a standard in most browsers, but anonymous browsing goes a step further. What attracts me is not so much the privacy aspect, but rather the security potential, because all of the anonymizing browser proxy based services create a secure encrypted connection between the PC you are using and the first anonymizing proxy server. [They’d grow old trying to figure that out.] “This allows you to safely transmit information with ... little risk of local interception, making it ideal for surfing on open Wi-Fi networks, or in hotels [, or anywhere,] while traveling. Previously, secure surfing on such networks required the use of private VPN networks, generally an option only available to corporate employees, those with the available money to pay for it and the technically savvy. . . . Whatever the reasons anyone may have for using anonymizing browsing, commercial services that offer anonymity are doing well, and a number of both free and subscription based browsing applications and services have become available.” Remember the 1998 movie Enemy of the State? Well, you darn well should. If not, hustle out and get it at the closest movie rental store, and then imagine yourself in the place of the lawyer character Will Smith is portraying? It can really happen, and it can happen to you, and most definitely on the web, as well! 4 What is the cost of ~? The first consideration for us here probably has to be the “Total Cost of Ownership (TCOO). To fully appreciate the value of anonymity online, consider the basics of web browsing. Pricing for the service runs the gamut from ‘Free’ to $9.95-$13.95/month; and purchased usually in the Page 9 Blue Chips Magazine — May 2011 $30-$40 range with one year of proxy server service. And ‘Free’ is always good, right? But, in this case I’m just not so sure, as are others with a lot more experience in this matter than I. For instance consider these questions: 1) Who exactly pays for the Bandwidth you will use?; 2) The persons controlling the proxies are in a ‘great’ position to exploit you, if they so desire, and then again, how do you know they aren’t?; 3) What services are offered by these proxies, if any, and who provides the Tech Support, if needed?; and, 4) How do you know there isn’t a Trojan Horse, or some such creature, embedded in the software they use? Et cetera. Et cetera. There are many free proxy programs for anonymous surfing, but most rely on using ‘unwilling’ proxy servers. These are private business servers configured incorrectly to leave open ports, which anonymous surfing programs can exploit. Enthusiasts use port scanners to check for unsecured networks, then they post those addresses publicly on a daily basis. When administrators realize the breach, the port is normally closed. Therefore, using manual anonymous surfing programs means constantly perusing the available list of proxy servers, and changing them accordingly. Purists are willing to do this, because they believe it is the safest way to achieve anonymous surfing.” FYI Lifehacker at <http://lifehacker.biz/> has some “Free” anonymous surfing sites listed for you to check out - If that’s the way you way to be! ;-} The alternative is to join a Web service that will provide a toolbar to use in place of the standard URL (Universal Resource Locator) in your browser. You can surf normally, using the toolbar address field to enter website addresses. The toolbar calls upon its own server to act as the proxy. Most sites that provide anonymous surfing of this type charge a monthly or yearly fee for the service, while others offer free trials. Certain websites do indeed offer free anonymous surfing, but the client must surf from their website. Moreover, the proxy handles requests from paying clients before handling free proxy requests, which can ultimately make anonymous surfing veerryy sloooww. But then, after all you get what you pay for, don’t you? “Free” isn’t really free; you have to pay the piper someway/somehow (See pitfalls below). 5. How is ~ done? This is where our Review of Ghost Surf 6 enters the picture (See the actual Review immediately following this Security-Related Report). a. The leading web anonymizers are simply web sites that proxy HTTP requests. Caveat. However, some features in the leading browsers allow remote web sites to collect this information about you and your PC “even when a page is accessed using anonymizers” (See Graphics on pages 20 and 21). For example, using JavaScript, a remote site can retrieve the local machine’s IP address and send it to the remote server. Also, using special HTML tags (like the META tag’s REFRESH property (See Symantec Vision 2011 Above and See Graphics on pages 15 through 19) can silently redirect the browser to the “original site,” bypassing the anonymizer (without the user’s knowledge). These issues basically render the anonymizers ineffective, since they do not really hide information from a remote site. [See Symantec Vision 2011 Conference Above and See Graphics on pages 15 through 19]. b. In the meantime, all users’ identities are verified instantly with servers based on a unique machine fingerprint that each computer has. Caveat. From this point on, all subsequent user activity from their original location can be traced directly back to that location, albeit their home (or office), or even the network that is connecting to any local, or national ISP, on their behalf. c. After typing in the URL of the desired web site, for example, our imaginary <www.somewhere.com>, the anonymizer will retrieve and display the HTML page using the anonymizer’s server instead of the client’s machine. In this case, the remote server knows nothing about the client’s machine, only what’s coming from the anonymizer’s server. d. Ever wonder how web sites seem to know so much about users? Well, without an anonymizer server shielding them, once a user is online, everything they do is recorded and stored in various ways. For example, within moments of logging online, packets of data are dumped back into the user’s cache, cookies are planted, and trails are laid that connect the dots from their starting and ending points online. e. At the end of each browsing session, each and every site they visited has recorded where they had been before they arrived, what they did at that site, how long they stayed, and what they did next. And then, simply because of this record about their surfing activities, the very next time they go online, any previously visited site(s) will know that they’ve returned, and consequently, can tailor their advertisements directly toward the user, or simply bombard them with junk, if they choose to do so. BTW Question. Have you ever wondered how some of those sexually explicit images just up and appear on your browser for no reason, or on the very next time you go surfing? Page 10 Blue Chips Magazine — May 2011 Answer. Well, you probably just accidentally hit that porno web site along the way, then too, or maybe you were directed there without you ever knowing how it happened, right (See Graphics on pages 15 through 12)? Well, that’s what this Security-Related Report is trying to get across to you, “Stuff happens,” you know. Well, at least that’s what the bumper stickers/ license plates tell us, anyway! ;-} 6. When is ~ done? It’s done all the time. And you’ll be doing it too, after you’ve once read the Ghost Surf 6 Review, I’m sure. Meanwhile, here’s some sound advice we all should take to heart. It comes from Jim Rjindael. FYI. Our current Encryption standard, the Advanced Encryption Standard (AES) Algorithm (Rjindael), is based upon, and named for this man’s work. “Sit you up and take heed,” as Yoda would implore us to do. Jim says, “I have worked in IT security for nearly 20 years and have seen how ‘experts’ deal with security. I don’t trust anyone with my information or details. As such I write under the awful but recognizable [sic, he’s English] corruption of the magnificent cipher developed by Joan Daemen and Vincent Rijmen. The Internet is an information gold mine - just make [sure] your personal details aren’t included. Our governments, identity thieves and all sorts of people with different agenda are watching us[, just] make sure you stay low key online!” - Jim Rjindael EzineArticles.com Expert. Note. Jim has written 24 articles on Anonymous Surfing, see them all at: <http://ezinearticles. com/?expert=Jim_Rjindael> Also Note FYI. Information on the AES algorithm (Rjindael) is available, including test values, intellectual property (IP) statements, and specifications. Those who are interested in the AES specification (i.e., the actual standard) should refer to the FIPS 197. You can also do a search for “Jim Rjindael”. A point of reference. My U.S. patented DYCRAV AutoEnc Security Suite Application (See my August 2006 BCM Review 1 & 2) uses the AES 256-bit Encryption Algorithm (Rjindael) to secure the Drag and Drop (DnD), Dual-layer, Compressed and Encrypted file(s). 7. Where is ~ done? Again we hear from Jim Rjindael. “Real Anonymous Internet Surfing takes some Effort. There are many people out [there working very hard] to trap our data and surfing patterns, [such as] hackers, identity thieves, spammer[s] and even our Governments (See Graphics on pages 20 and 21). Just searching for a few free anonymous proxies on the Internet is unlikely to be a great experience. Even if you are lucky enough to avoid the proxies that have been deliberately set up to trap the thrifty anonymous surfer by some Eastern European Identity thieves, you may find one of the servers which has been setup to track your surfing and then send you a deluge of targeted SPAM. [See Symantec Visions 2011 above] “Those who find a clean anonymous proxy[,] which does its job[,] will eventually probably give up using it because it will be incredibly slow. All the time your every visit to every website will be logged and recorded at your local ISP - along with your emails backed up on tape and left there for who knows to see. “If you really want to have anony- mous Internet surfing - you need a fast secure anonymous proxy, the facility to switch proxies seamlessly with no effort [and], all your web traffic needs to be encrypted from the client and back again. You will then be completely anonymous online and your ISP logs will be completely secure and unreadable to anyone just like mine!” - Jim Rjindael, Anonymous Internet Surfing - The Art of Surfing in Secret Back to Surfing Basics. Say What? Before we leave the subject of introductory “safe surfing,” with tongue in check, we see that truth is indeed stranger than fiction. Point in fact: U.S. Adults Choosing Internet Over Sex. “Nearly half of the women aged 18 to 44 surveyed, or 46%, said they would rather go without sex for two weeks than give up the Internet for the same amount of time. . . . Some 30% of the male respondents said the same. . . . The November poll, . . . found that most adults consider the Internet essential to daily life in the current economic downturn. . . . Finally, more than nine out of 10 adults said the Internet has improved at least one aspect of their lives. Within this group, the most popular improvements included staying in touch with friends and family and being able to shop more effectively.” - Antone Gonsalves, InformationWeek (December 15, 2008) If what Gonsalves reports can truly be believed, then one can certainly understand why Anonymous web surfing might be high on that 46% group of women’s list of priorities. Makes immanent sense to me, as it allows a user to visit Web sites without allowing anyone to gather information about which sites the user visited. I just have to wonPage 11 Blue Chips Magazine — May 2011 der about their “SAFE surfing” habits though (See Graphics on pages 20 and 21)? A. N. Onymous claimed: “Liberals are very broad-minded; they are always willing to give careful consideration to both sides of the same side.” As we come to a close on this S-R edition, I’d like point out that Tenebril’s GhostMyMail (either Standalone or in GhostSurf Platinum) is yet another method of maintaining “anonymity” out there in the all-to-real, big, bad Internet world (More on this and other anonymous programs will be covered in Review immediately following). GhostMyMail provides Spam Prevention & Identity Protection via e-mails. For instance, you can: stop spam by hiding your real email address; prevent scammers and viruses from reaching your inbox; and, create temporary, anonymous email accounts quickly. “The more you shop, surf, or socialize online, the more you risk getting a lot of spam, but you can stay ahead of the spammers by using a temporary, anonymous email address every time you shop or chat.,” states Tenebril. Flash! This Just In. . . Consumer Reports, Issue June 2011, just arrived at our mail box. At the present time I plan on this being the basis for next month’s main topic of coverage for my next Security-Related Report, it’s that important, and is it current. The cover (see Graphic) says, “Your Security: 25 things cops & crooks say you’re doing wrong.” But, don’t wait for me, get over to your local library and get a head start on protecting your own security. Report 1 & 2 (August 2008); Security News n Views Part 2 Report 1 & 2 (September 2008); and, Security News n Views Part 3 Report 1 & 2 (November 2008). And, it’s also time to bid you a fond adios/adieu/ goodbye, and point you in the direction of the Ghost Surf 6 Review, which appears on the very next page. Enjoy! Bon Chance! It’s time now with a eye on the future to respectfully remind you to surf safely and for additional security information please refer to the May 2008 BCM Security-Related News and Views 101 Report 1 & 2, as well as, all the other Security-Related Reports 1 & 2 in the series I’ve been sharing with you here over the years in BCM. Note. I invite you to pay particular attention to the 2008 series: Encryption -What’s That Report 1 &2 (July 2008); Encryption - Why Footnotes 1 If you are reading this Review from directly off of an Internet search, you are seeing it in HTML (or text) format. Yuk! There’s No Graphics there! To see all the beautiful Graphics in this Review - the ones that we’ve worked so very hard to entertain you with - you will need to follow the procedures outlined in Footnote 2 below. Enjoy! Again, our web page (www. ucs.org). 2 See the actual Reports/Reviews in the Blue Chips Magazine (BCM) Archives (i.e., begin search on left-hand side of web page) at (www.ucs.org). Note. Always choose the center option, i.e., PDF format for its beauty. 3 Feature(s) precisely identified as reason(s) for designating this Review/Report as “Security-Related.” Page 12 Blue Chips Magazine — May 2011 In this case, everything. 4 My Hard Earned Byline: Happiness Is A Working Computer (HIAWC). 5 Kellogg’s Nut & Honey Cereal of the 80’s and early 90’s TV Commercial fame; “What are you eating? Nut ‘n Honey! ex post facto Adj. Formulated, enacted, or operating retroactively. Used especially of a law. [Latin ex postfact : ex, from + postfact, ablative of postfactum, that which is done afterward.] Source: The American Heritage Dictionary of the English Language, Fourth Edition copyright ©2000 by Houghton Mifflin Company. Updated in 2009. Published by Houghton Mifflin Company. All rights reserved. 6 Thesaurus Adj. 1. ex post facto - affecting things past; “retroactive tax increase”; “an ex-post-facto law”; “retro pay” retro, retroactive, retrospective concerned with or related to the past; “retrospective self-justification” Based on WordNet 3.0, Farlex clipart collection. © 2003-2008 Princeton University, Farlex Inc. Page 13 Blue Chips Magazine — May 2011 Page 14 Blue Chips Magazine — May 2011 Page 15 Blue Chips Magazine — May 2011 Page 16 Blue Chips Magazine — May 2011 Page 17 Blue Chips Magazine — May 2011 Page 18 Blue Chips Magazine — May 2011 Page 19 Blue Chips Magazine — May 2011 Page 20 Blue Chips Magazine — May 2011 Page 21 Blue Chips Magazine — May 2011 GhostSurf 6 Windows Review Affordable Anonymity on the Internet Reviewed by Don Nendell Manufacturer: Process Software 959 Concord Street Framingham, MA 01701 Phone: (800) 722-7770 (508) 879-6994 FAX: (508) 879-0042 e-mail: [email protected] Tech Support: Hours of operation: 8:30 A.m. to 7:00 P.M. EST E-mail support is available 24/7. You can use their support web page to send your question to Tenebril’s customer service representatives. You will receive a response ASAP by e-mail. Phone Support is available for purchase. If you purchase phone support, the support phone number will be in your confirmation e-mail. System requirements: Supported Operating Systems: Windows 2000 SP4/XP SP2/Vista (32 bit only) Minimum System Requirements: CPU: 300 MHz or better 256 MB RAM 80 MB hard disk space Internet Explorer 6.0 or higher Internet connection (for automatic updates) Simple Description: Anonymous Internet connections that allow you to “Surf the Internet Invisibly, Securely and Affordably” Where to purchase: GhostSurf 6 is available immediately on the Internet at <www.tenebril.com>, as well as from the extensive network of Tenebril Authorized Resellers. GhostSurf 6 is also sold through all major electronics retailers. Pricing: GhostSurf 6 with 1-Year Updates $29.95 (Backup Disc $9.99 & Extended Download Service $5.99) 2-user license: $49.95 5-user license: $119.95 10-user license: $229.85 Page 22 Blue Chips Magazine — May 2011 (See Free Trials Graphic) Benefits: 15-day “Free” trial Surf Anonymously Encrypts Your Internet Connection (most advanced encryption yet!) Prevents identity theft Improved faster connection Save on New GhostSurf 6 (See User licensing pricing above) About Tenebril Tenebril, Inc. is a leading security and privacy technology company creating innovative, award-winning solutions for home and enterprise customers. Unlike traditional approaches to the growing spyware problem, the patent-pending Tenebril Spyware Profiling Engine™ is uniquely capable of defeating quickly-mutating spyware to provide zero-day protection. Led by a seasoned team of software industry veterans, the company’s product lines are distributed worldwide via multiple channels including e-commerce, retail, security experts, and a direct sales force. Tenebril was founded in 1998 and was acquired by Process Software, a unit of HALO Technology Holdings, Inc. (OTCBB: HALO) in August 2006. Process Software (www.process. com) is a premier provider of communications software to mission critical environments. With over 20 years in business, Process Software serves thousands of customers, including many Global 2000 and Fortune 1000 companies. Free Tenebril Software Downloads (See graphic) NEW! SpyCatcher. Express version 5.1 has been updated with a new Spyware Profiling Engine. It protects all web surfers by providing the safest and most advanced anti-spyware solution available as a free service. DriverScanner 2009: DriverScanner releases the hidden potential of your computer by delivering fast and effective PC driver updates and backups. RegistryBooster 2009:This free stability scan and registry cleaner download will give you a complete diagnosis of your Windows registry, identifying errors and conflicts. SpeedUpMyPC 2009:This free scan will analyze the performance of your system giving you a complete diagnosis and a recommended set of improvements. About GhostSurf 6.0 Overview: Be invisible on the Internet. Web sites, advertisers, hackers, even snooping friends and family can easily watch your Web surfing. Information you type into Web sites, including your name, address and credit card number is often sent unprotected and can be read by others as it travels over the Web. Hackers can use your IP address to launch attacks against your computer, causing damage or allowing theft of your data. At the same time, your PC automatically collects and stores information about your online activities. This data is visible to anyone with access to your machine. GhostSurf 6.0 (Six-O) is the answer. GhostSurf 6.0 provides a secure and anonymous Internet connection to let you surf the Web invisibly. It works with all Web browsers, and also supports instant messengers, newsgroups feeds and popular chat programs. Features: Surf Anonymously - With a simple click, GhostSurf ensures your privacy and shields your computer and IP address from a variety of Internet threats. An intuitive slider bar makes choosing your privacy settings a breeze. Prevent Identity Theft - GhostSurf protects you from criminals out to steal your identity. GhostSurf masks your IP and keeps you invisible on the Internet. An IP address can convey a lot of information about you, even who you are and where you live. Encrypt Your Data - Three levels of private surfing allow you to control what information leaves your computer and who gets to see it. At the highest level, browsing is fully-encrypted-your surfing is completely invisible no matter where you go on the Web. Every page you visit, every search you do, even every instant message you send is protected by strong encryption. Prolog Red Skelton, famed comedian (July 18, 1913 - September 17, 1997), said, “All men make mistakes, but married men find out about them sooner.” Ergo, CYA Disclaimer: No matter how this looks to all of you, I am not, repeat NOT, in the habit of reading any “Advice to the Troubled/Lovelorn” columns. But, this particular piece was just sitting there on the Salt Lake Tribune Comic Section right next to my JUMBLE PUZZLE, as “Big As Life,” and, needless to say, I just couldn’t pass it up, you see? Anyway, being very apropos to our Review subject herein, plus it being a real first for me, as well, here it is FYI. “While Im away, readers give the advice” - Carolyn Hax, Salt Lake Tribune Advice Column Writer, Salt Lake Tribune, 12/26/08, p.E14. Privacy is dead in the electronic world. On spying on teenagers. The sooner that children [ALL THE PEOPLE (my emphasis here)] learn that electronic communications are not private, the better they will be. Teenagers, and for that matter, many adults, seem to think that their electronic communications can remain private. Messages (and photos) on Facebook, MySpace, e-mail, iChat and cell phones are not private. They are easily retrieved, by those who are not particularly technologically savvy and by those who may not have your children’s [OR THE PEOPLE’S (my emphasis here)] best interests at heart. Online messages may easily be viewed by people other than the intended recipient. These messages can live forever in cyberspace. . . . There is no such thing as respecting electronic boundaries. The newspaper is filled with stories of people who went to jail because they failed to realize that electronic communications are almost impossible to erase completely. - A Mother Who Is Weary of Fighting This Battle, Among Others. . .” The Concern Is? There are many, and varied, good reasons people have for wanting to surf anonymously. They run the gamut. They range from outright simple paranoia of protecting personal data, to hiding Internet browsing activities from anyone and everyone, which may include parents, spouses, or other persons and/ or organizations. Simply stated, they want anonymity, which is defined as follows: Wordnet: The noun has one meaning: the state of being anonymous Synonym: namelessness Page 23 Blue Chips Magazine — May 2011 Wikipedia: Anonymity is derived from a Greek word meaning “without a name” or “namelessness”. In colloquial use, the term typically refers to a person, and often means that the personal identity, or personally identifiable information of that person is not known. Noun. anonymity (countable and uncountable; plural anonymities) 1. (uncountable) The quality or state of being anonymous; anonymousness. 2. (countable) That which is anonymous. Verb. to anonymize (third-person singular; simple present anonymizes; present participle anonymizing; simple past and past participle anonymized) 1. (transitive) To render anonymous. Adjective. anonymous 1. Wanting a name; not named and determined, as an animal not assigned to any species. 2. Without any name acknowledged, as that of author, contributor, or the like: as an anonymous pamphlet; an anonymous benefactor; an anonymous subscription. 3. Of unknown name; whose name is withheld: as, an anonymous author. Synonyms. nameless, unidentified, unknown, unnamed So, What’s It All About, Alfie? By surfing the Web you are exposed to hackers, bombarded by advertisements and subjected to spyware, malware, Trojans, BOTS, and a whole host of other nefarious “Bad Guys!” Everything you do and download while you are surfing the Internet, can be watched. Hackers, Webmasters, and even your boss, whomever that may be, plus others who might access your computer, can easily see your surfing habits. Worst case scenario. Your personal data (albeit medical, financial, credit card information, et al.), is most definitely easily readable. To which Tenebril responds, “Since anti-virus and firewall programs do not adequately address these issues, the obvious answer has to be GhostSurf 6.0 (Six-O) or GhostSurf Platinum (GSP). GhostSurf provides a secure surfing experience by protecting your privacy and preventing damaging Internet threats from infecting your PC. GhostSurf ensures your safety online with an anonymous, encrypted Internet connection.... [It can accomplish this because] GhostSurf provides not only the ability for anonymous surfing through anonymous proxy[,] but gives you the option to surf anonymously with [an] encrypted internet connection. . . . With GhostSurf, you’re invisible and in control online.” OK! OK! Before GS 6.0 (Six-O) May I respectfully suggest that at this juncture you refer to my previous Introduction to GhostSurf 6.0 Report (See pg. 4 of this BCM 1 & 2 issue) for a more complete rundown on Anonymous Web surfing. But, as a quick refresher, it goes something like this: 1) Services that provide anonymity disable pop-up windows and cookies and conceal the visitors IP address; 2) These services typically use a proxy server to process each HTTP request; 3) When the user requests a Web page by clicking a hyperlink or typing a URL into their browser, the service retrieves and displays the information using its own server; and, 4) The remote server (where the requested Web page resides) receives information about the anonymous Web surfing service in place of the users information. Which brings us to. . . . GhostSurf Six-O, Front and Center! Sir, Yes Sir! [We listen in on a tense dialog between Top Sergeant and Six-O in the Forward Staging Area:] Top: Six-O, the General has decided not to send you out into the field, just yet. He is sending your bigger, more experienced cousin, Platinum, on this dangerous mission. Six-O: But Sir, wha...? Top: You’re a better soldier than that, Six-O, you know better than to ever question a General’s orders? Six-O: Sir! Yes sir! Top: By now you know that the Group’s policy is: “...Ours is not to reason why, ours is but to do and die!” 5 Six-O: Sir! Yes sir! Top: Return to the training area, soldier... Dismissed! Six-O: Sir! Yes sir! Top: (Under his breath): “Nolite te bastardes carborun-dorum, Six-O!” 6 Six-O: (Under his breath): You can count on it, Sarge. In Conclusion Sorry, but since Six-O, I mean, GhostSurf 6.0, is not going on the mission, at this time, we will not be critiquing his services as a consequence. Please refer to my BCM Review of GhostSurf 5.5 (Platinum) in the BCM January 2009 issue 1 & 2. FYI. GhostSurf 5.5 (Platinum) is the right tool, um.. man for the job, bar none. Good hunting, Before we go, I wonder, “What if?” I wonder, would we even have that old fable to share with our children if Little Red Riding Hood would have been invisible to the “Big Bad Wolf” by being shielded with a GhostSurf Platinum-like “Ghillie suit?” Well, it’s a thought? Because now, we can add surfing anonymously to our layered defense plan, GhostSurf Platinum, to be precise. Just remember, HIAWC 4, especially an invisible one running GhostSurf Platinum. Get it today. You’ll be ever thankful for the advice, and be greatly relieved when you do. Amen! Ciao! “If some day you’re not feeling well, you should remember some little thing I have said or done and if it brings a smile to your face or a chuckle to your heart then my purpose as a clown has been fulfilled.” - Red Skelton Footnotes 1 If you are reading this Review from directly off of an Internet search, you are seeing it in HTML (or text) format. Yuk! There’s No Graphics there! To see all the beautiful Graphics in this Review - the ones that we’ve worked so very hard to entertain you with - you will need to follow the procedures outlined Page 24 Blue Chips Magazine — May 2011 in Footnote 2 below. Enjoy! Again, our web page (www.ucs.org). 2 See the actual Reports/Reviews in the Blue Chips Magazine (BCM) Archives (i.e., begin search on lefthand side of web page) at (www. ucs.org). Note. Always choose the center option, i.e., PDF format for its beauty. 3 Feature(s) precisely identified as reason(s) for designating this Review/Report as “SecurityRelated.” In this case, everything. 4 My Hard Earned Byline: Happiness Is A Working Computer (HIAWC). 5. “ Ours is not to reason why ...”, Sarage, is quoting from Tennyson’s(*) poem The Charge of the Light Brigade. The line ‘Ours is not to reason why, ours but to do and die’ speaks of the removal of all choice over one’s fate (the painting of the Charge of the Light Brigade is by Caton Woodville) Source: Book Drum, pg. 188. Alfred, Lord Tennyson (1809-1892) was Poet Laureate from 1850 to his death, the longest serving in that post during Queen Victoria’s reign. His most famous works include The Charge of the Light Brigade and In Memoriam A.H.H. 6. “Nolite te bastardes carborundorum.” (“Don’t let the bastards grind you down.”) The mock-Latin phrase originates from World War Two. It is also the first line of the unofficial school song of Harvard University, and has been popular with generations of students there. Since the story is set in Cambridge, Massachusetts, the location of Harvard, this is significant. Source: Book Drum, pg. 188 Even the Blue Oracle Can’t Create New Members. It’s up to YOU to Bring Them to Our Meetings. Page 25 Blue Chips Magazine — May 2011 Page 26 Blue Chips Magazine — May 2011 Utah Blue Chips Calendar May 2011, June 2011 UBC General Meeting U of U 7:00 p.m. Magazine Deadline Design U of U 7:00pm UCS Board of Trustees C&C Bldg. Room N3005 6:30 p.m. UBC General Meeting U of U 7:00 p.m. TBA Magazine Deadline Blue Chips — Utah’s Computer Guide in the 21st Century
Similar documents
special ucs ces 2009 report
available as a standard in most browsers, but anonymous browsing goes a step further. What attracts me is not so much the privacy aspect, but rather the security potential, because all of the anony...
More information