Cyber Security Awareness Month - Day 4 - Managing EMail

Published: 2010-10-04
Last Updated: 2010-10-11 17:43:30 UTC
by Daniel Wesemann (Version: 1)
5 comment(s)

We covered phishing and other nefarious fraudulent emails in yesterday's diary. Today's entry is about preventing unauthorized access to your email and some email handling issues.

Unauthorized Access to your email can occur for a number of reasons

  • you picked a simple password, and someone guessed it
  • you picked a good password, but someone guessed the "password reset" question (remember "Wasilla High" ?)
  • you accessed your email account from an unsafe public terminal
  • you accessed your email account from a safe personal computer, but did not use SSL

Derived from this are a few steps you can take to make things harder for snoops:

  • Pick a good long password. And do change it every now and then. I am certainly no fan of "change your password every xx days" rules, but for online email, changing it on occasion actually makes good sense -- it is your only chance to lose any "stalkers" you might have picked up over time. Your ex, your dorm roomie, etc, might know your password, and can passively snoop your inbox without you ever noticing. Only changing the password shakes them off.
  • Actually go through the "I forgot my password" routine once. Just pretend that you don't remember the password. And then watch carefully how hard (or not) it actually is to regain access. There are still mail providers out there who require you to have a 10-character password, but at the same time force you to use "The color of your first car" as a password reset question. Having a password reset option is good (heck, I also forget passwords if the vacation is good and long :), but the reset option should be as hard to guess or fake as the original sign-on. If you got the choice, pick a provider that allows you to write your own question/answer pair and that includes some sort of out of band notification like SMS.
  • For the unsafe public terminal, well, don't log into your email there. Within a couple months, all of us will anyway carry web enabled mobile phones, and those shady airport and hotel PCs will hopefully then follow the "internet cafe" into merciful obscurity.
  • If you are already using a mobile phone or *pad or *book for email access "on the go", make sure that your email client is set to use SSL/TLS. HTTP, IMAP and POP3 should all be avoided if they are not paired with SSL/TLS for encryption (HTTPS, for example). Remember, WiFi signals can be intercepted and recorded by everyone in range. Without encryption, eavesdroppers get to see your login credentials and all the email that you download and read.

EMail Handling

"Reply to all" was not invented for people who click faster than they think. On occasion, these embarrassing broadcasts of a person's naiveté make everyone at the office cringe. Thus, if you are using "reply to all", check carefully who is on the recipient and cc: lists. And do everyone a favor and never reprimand a hapless reply-to-all person by also replying to all with an admonishment. 

"Unsubscribing" also has its pitfalls. If you try to unsubscribe from some list that you never actually subscribed to, chances are that you just confirmed to some spammer that you actually read their email. Only use "unsubscribe" on things that you vaguely remember ever having signed up to, and use "mark as spam" for all the rest.

Last but not least, EMail is a poor medium to convey irony or sarcasm. As useful as email is, the more contentious a discussion gets, or the more back-and-forth replies pile onto replies, the better off you likely are by picking up the phone, and having an old-fashioned talk.

If you have other tips on how to keep email safe and secure, please comment below or use the contact form.

5 comment(s)

Online Voting

Published: 2010-10-04
Last Updated: 2010-10-05 00:16:44 UTC
by Mark Hofman (Version: 1)
0 comment(s)

We've just had a long weekend here in AU so being at work on a Tuesday morning is always a little bit depressing.  However today a little article in wired caught my attention and made me chuckle "Voting System pwned by Michigan Wolverines" ( and in the Washington Post "Hacker infiltration ends D.C online voting trial" (

The crux of the story is that computer experts were asked to prod the vulnerbilities of an online voting system. They did and ......  well the two headlines say it all.
If you need a chuckle, have a read.


Keywords: online voting
0 comment(s)
Snort 2.9.0 is out, see the release notes on

SQL Slammer Clean-up: How to Report

Published: 2010-10-04
Last Updated: 2010-10-04 00:50:30 UTC
by Kevin Liston (Version: 1)
3 comment(s)

Hopefully you've read the kick-off ( and have looked at bit at your logs. Perhaps you've worked out what the cost of slammer is to your network on the back of a npkin. In most instances it probabably would cover the price of your lunch, or it's enough to justify the small amount of time this exercise will cost you.

Create a simple spreadsheet listing the IP addresses that have been hitting your perimeter. You'll want to track who the abuse contacts for that network are, when you send your notice, and what kind of response that you get (we'll add more columns later this week.)

Next you'll be running a few WHOIS requests. Everyone has a favorite way to do this (send in your comments on what you think is the easiest way pull abuse contact information.) Depending on your resources, you may have time to tackle all of them, others may only have time to do handle 25 or so. Everyone should try at least ten, if only to get a good sample of the different types of response that you get from your first efforts. Just remember that there are a lot of people doing this along with you this month.

When you compose your first message I want you to keep a few things in mind:

  • Be polite and professional-- you are trying to enlist the help of a stranger. Take a look at some of the emails that come into your abuse contact email if you have access. Mimic the alerts that you respond positively to, avoid the behaviors of those you dislike.
  • Provide logs-- if you don't initially provide logs, that will be their first request of you. Demonstrate that you're on the level with your first message and set them up to succede. It's ideal to provide the logs in GMT, but if that's not convenient, provide the GMT offset for your logs. There is no shame in getting probed/scanned on your perimeter, so there is very little to hide from them.

Feel free to cite these diary entries or use us as a reference. Tom Liston has other (humorous) tips on how to make an abuse report here:

Take a few minutes to reach out. Statistically-speaking, you're most likely to get no response or an error message (we'll cover how to proceed in those cases later,) so don't be daunted or give up because of that.


Keywords: slammercleanup
3 comment(s)


What's this all about ..?
password reveal .
<a hreaf="">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
<a hreaf=""> public bathroom near me</a>
<a hreaf=""> nearest public toilet to me</a>
<a hreaf=""> public bathroom near me</a>
<a hreaf=""> public bathroom near me</a>
<a hreaf=""> nearest public toilet to me</a>
<a hreaf=""> public bathroom near me</a>
Enter comment here... a fake TeamViewer page, and that page led to a different type of malware. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs.
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
Enter corthrthmment here...

Diary Archives