Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Cyber Security Awareness Month - Day 4 - Managing EMail

Published: 2010-10-04
Last Updated: 2010-10-11 17:43:30 UTC
by Daniel Wesemann (Version: 1)
5 comment(s)

We covered phishing and other nefarious fraudulent emails in yesterday's diary. Today's entry is about preventing unauthorized access to your email and some email handling issues.

Unauthorized Access to your email can occur for a number of reasons

  • you picked a simple password, and someone guessed it
  • you picked a good password, but someone guessed the "password reset" question (remember "Wasilla High" ?)
  • you accessed your email account from an unsafe public terminal
  • you accessed your email account from a safe personal computer, but did not use SSL

Derived from this are a few steps you can take to make things harder for snoops:

  • Pick a good long password. And do change it every now and then. I am certainly no fan of "change your password every xx days" rules, but for online email, changing it on occasion actually makes good sense -- it is your only chance to lose any "stalkers" you might have picked up over time. Your ex, your dorm roomie, etc, might know your password, and can passively snoop your inbox without you ever noticing. Only changing the password shakes them off.
  • Actually go through the "I forgot my password" routine once. Just pretend that you don't remember the password. And then watch carefully how hard (or not) it actually is to regain access. There are still mail providers out there who require you to have a 10-character password, but at the same time force you to use "The color of your first car" as a password reset question. Having a password reset option is good (heck, I also forget passwords if the vacation is good and long :), but the reset option should be as hard to guess or fake as the original sign-on. If you got the choice, pick a provider that allows you to write your own question/answer pair and that includes some sort of out of band notification like SMS.
  • For the unsafe public terminal, well, don't log into your email there. Within a couple months, all of us will anyway carry web enabled mobile phones, and those shady airport and hotel PCs will hopefully then follow the "internet cafe" into merciful obscurity.
  • If you are already using a mobile phone or *pad or *book for email access "on the go", make sure that your email client is set to use SSL/TLS. HTTP, IMAP and POP3 should all be avoided if they are not paired with SSL/TLS for encryption (HTTPS, for example). Remember, WiFi signals can be intercepted and recorded by everyone in range. Without encryption, eavesdroppers get to see your login credentials and all the email that you download and read.


EMail Handling

"Reply to all" was not invented for people who click faster than they think. On occasion, these embarrassing broadcasts of a person's naiveté make everyone at the office cringe. Thus, if you are using "reply to all", check carefully who is on the recipient and cc: lists. And do everyone a favor and never reprimand a hapless reply-to-all person by also replying to all with an admonishment. 

"Unsubscribing" also has its pitfalls. If you try to unsubscribe from some list that you never actually subscribed to, chances are that you just confirmed to some spammer that you actually read their email. Only use "unsubscribe" on things that you vaguely remember ever having signed up to, and use "mark as spam" for all the rest.

Last but not least, EMail is a poor medium to convey irony or sarcasm. As useful as email is, the more contentious a discussion gets, or the more back-and-forth replies pile onto replies, the better off you likely are by picking up the phone, and having an old-fashioned talk.

If you have other tips on how to keep email safe and secure, please comment below or use the contact form.

5 comment(s)

Online Voting

Published: 2010-10-04
Last Updated: 2010-10-05 00:16:44 UTC
by Mark Hofman (Version: 1)
0 comment(s)

We've just had a long weekend here in AU so being at work on a Tuesday morning is always a little bit depressing.  However today a little article in wired caught my attention and made me chuckle "Voting System pwned by Michigan Wolverines" (http://www.wired.com/threatlevel/2010/10/dc-voting-system-hacked/) and in the Washington Post "Hacker infiltration ends D.C online voting trial" (http://voices.washingtonpost.com/debonis/2010/10/hacker_infiltration_ends_dc_on.html)

The crux of the story is that computer experts were asked to prod the vulnerbilities of an online voting system. They did and ......  well the two headlines say it all.
If you need a chuckle, have a read.

Mark

Keywords: online voting
0 comment(s)
Snort 2.9.0 is out, see the release notes on http://www.snort.org/snort-downloads

SQL Slammer Clean-up: How to Report

Published: 2010-10-04
Last Updated: 2010-10-04 00:50:30 UTC
by Kevin Liston (Version: 1)
3 comment(s)

Hopefully you've read the kick-off (http://isc.sans.edu/diary.html?storyid=9637) and have looked at bit at your logs. Perhaps you've worked out what the cost of slammer is to your network on the back of a npkin. In most instances it probabably would cover the price of your lunch, or it's enough to justify the small amount of time this exercise will cost you.

Create a simple spreadsheet listing the IP addresses that have been hitting your perimeter. You'll want to track who the abuse contacts for that network are, when you send your notice, and what kind of response that you get (we'll add more columns later this week.)

Next you'll be running a few WHOIS requests. Everyone has a favorite way to do this (send in your comments on what you think is the easiest way pull abuse contact information.) Depending on your resources, you may have time to tackle all of them, others may only have time to do handle 25 or so. Everyone should try at least ten, if only to get a good sample of the different types of response that you get from your first efforts. Just remember that there are a lot of people doing this along with you this month.

When you compose your first message I want you to keep a few things in mind:

  • Be polite and professional-- you are trying to enlist the help of a stranger. Take a look at some of the emails that come into your abuse contact email if you have access. Mimic the alerts that you respond positively to, avoid the behaviors of those you dislike.
  • Provide logs-- if you don't initially provide logs, that will be their first request of you. Demonstrate that you're on the level with your first message and set them up to succede. It's ideal to provide the logs in GMT, but if that's not convenient, provide the GMT offset for your logs. There is no shame in getting probed/scanned on your perimeter, so there is very little to hide from them.

Feel free to cite these diary entries or use us as a reference. Tom Liston has other (humorous) tips on how to make an abuse report here: http://isc.sans.edu/diary.html?storyid=9325

Take a few minutes to reach out. Statistically-speaking, you're most likely to get no response or an error message (we'll cover how to proceed in those cases later,) so don't be daunted or give up because of that.

-KL

Keywords: slammercleanup
3 comment(s)
Diary Archives