ITS Technology Tips

Your laptop’s battery life can be extended if you take precautions to avoid frequent total discharges. One step you can take is to set up alerts so you’ll know to plug in the power adapter when the battery goes down to a particular level.

Almost all laptops display alerts if the battery has 5% or 10% of the charge left. You can easily modify your notifications to avoid total discharges.

In Windows 7, click on your battery icon in the system tray and select More power options, then select  Change plan settings -> Change advanced power settings and change the  low level battery setting to 30% and the critical level battery setting to 25%.

It is also recommended to keep the battery in cool temperatures to make battery life last longer.

Additionally, if you are planning not to use your laptop for a long time (for example when you go on vacation), make sure it is charged about 40% before you unplug the power adapter and power down.

No matter how many steps you take to protect yourself or your information, there is still a chance you will get hacked. However, the sooner you identify you have been compromised and the faster you respond, the more you can minimize the harm.

ACCOUNTS

You probably have numerous online accounts for everything from online banking and shopping to email and social networking. Keeping track of them can be a constant challenge. Here are some steps to help you identify and respond to compromised accounts.

Symptoms:

1. You can no longer log in to the website, even when you enter the correct password.
2. Your friends & co-workers are receiving emails from you that you never sent.
3. Someone is posting messages on your social networking page (such as Facebook or Twitter), posing as you.
4. Someone is transferring money out of your online bank account.
5. Contact information or other settings on your online accounts are being changed without your knowledge.
6. When a website or service provider publicly announces they have been hacked and user accounts/passwords have been compromised.

Response:

1. If you can still log in, change your password immediately and be sure to use strong passwords.
2. If you can’t log in, contact the service provider or website immediately.
3. Once you have regained access, review all of your account settings to make sure nothing has been changed by the attacker.
4. Make sure you change your password on any other accounts that have the same password.

DEVICES

With the explosion of mobile devices, you now have even more things to protect. Once attackers control your device, they have the ability to intercept every action you take on that device. Here are some steps to help you identify and respond to infected devices.

Symptoms

1. Your computer is taking you to websites you do not want to go to & running programs that you never installed.
2. Your anti-virus reports an infected file/ Anti-virus and system updates are failing.
3. Your device is continually crashing.
4. Your smart phone is making expensive calls or purchasing apps without your permission.

Response:

1. Perform a full scan with your updated anti-virus solution. If it detects any infected files, follow the steps it recommends.
2. Make sure you install the latest version of your anti-virus & do regular backups of your personal Data.

INFORMATION

Protecting personal information, such as your Social Security Number, medical history, or purchase history, can be challenging, since you often do not control this data. Instead, organizations like your health care provider, your credit card company or your school store maintain this data. Here are some steps to help you identify when your personal information has been compromised and how to respond.

Symptoms:

1. A service provider announces they had an incident and your data may have been compromised, such as your credit card number or your medical history.
2. You see unauthorized charges on your credit card.
3. Your credit reports indicate loan applications you do not recognize.
4. Your health insurance is processing claims for treatments you did not receive.

Response:

1. Call your credit card issuer immediately & have them cancel the credit card and issue a new one.
2. If you believe there is fraud with your insurance account or bank account, call your insurance company or bank.
3. During any filing process, always document all conversations with date, time and the name of the person you talked to.

To learn more about the security solutions visit http://www.securingthehuman.org/

What Is P2P?

P2P stands for Peer-to-Peer which means the sharing of files between two or more users on the Internet. The concept behind P2P networking is powered by a peer-to-peer application such as Gnutella, KaZaA, Napster, iMesh, LimeWire, Morpheus, SwapNut, WinMX, AudioGalaxy, Blubster, eDonkey and BearShare. The P2P application takes a piece of allotted data or sometimes whole directories from your hard drive and allows other users to freely download this content, and vice versa. Content downloaded via P2P applications can be potentially laced with a computer virus or be legally protected copyright data. P2P programs are most often used to share music and videos over the Internet. Although sharing, by passing around a CD or DVD is not illegal; sharing by creating multiple copies of a copyrighted work is illegal.

How P2P Works

Much of the P2P activity is automatic and its use is unmonitored. Computers running this software will be busy exchanging files whenever the machine is turned on. Some of the P2P programs themselves contain “spyware” that allows the author of the program, and other network users, to see what you’re doing, where you’re going on the Internet, and even use your computer’s resources without your knowledge. Once installed, these applications are hard to remove. In some cases a user has to know which files to remove, which registry entries to edit, and which configuration files need modification. Since the computers running the P2P programs are usually connected to a network, they can be used to spread malware, share private documents, or use your file server for store-and-forward where data transmitted from one device to another passes through a message center which is used by the message service to store the transmitted message only until the receiving device can be located and then forwards the data transmitted to the intended recipient. Various types of illegal files can be downloaded and re-shared over these P2P networks by mistake. This includes child pornography, which can bring the owner of the computer and network under severe criminal penalties.

Risks from P2P Programs

Some P2P programs will share everything on your computer with anyone by default. Searches done so far revealed patent applications, medical information, financial and other personal and corporate information. Viruses, Worms and Trojans are being distributed at a fast rate.

Cybercriminals these days are using a modified version of the Zeusbot/SpyEye malware, which is using a peer-to-peer network, rather than a simple bot to command-and-control (C&C) server system, making the botnet much harder to take down. Also, P2P network enables the botnet to stay alive and gather information, even if portions of the network are shut down making it even more dangerous to use P2P software.

ZeuS is very popular in the cybercriminal world because it’s capable of stealing a wide variety of information, documents and login credentials from infected systems. Both ZeuS and SpyEye can be best described as cybercrime toolkits that are used for the creation of customized banking Trojans. The code base of the two former rivals was merged last year that led to the creation of strains designed to target mobile banking customers. Basically, if the control messages are handled by P2P networks, it is almost impossible to track the criminals behind it.

Consequences of Copyright Infringement

Downloading and sharing files which contain copyrighted material is against the law. The responsibility to restrict sharing and monitor the legality of your downloads lies solely with you. This is what can happen to you:

• Disciplinary action. Your name may be forwarded to the Dean of Students Office for disciplinary action. Sanctions include fines, termination of university network access and/o university probation.
• Legal consequences. Copyright holders may offer a legal settlement option (a.k.a. Early Settlement Letter) or pursue legal action against you.
• Financial implications. If a copyright holder chooses to pursue legal action, the minimum damage for sharing copyrighted material is $750 per file (in addition to legal and court fees). Some students who settled their cases outside of court were forced to pay substantial amounts. There is no way to predict how much you may be required to pay in settlement costs.

The Federal statute, titles 17 and 18 of the U.S. Code, provide criminal penalties for infringing on copyrighted material. In the worst case infringements can be punishable by up to five years in prison and $250,000 in fines. Repeat offenders can be imprisoned for up to 10 years. Violators can also be held civilly liable for actual damages, lost profits, or statutory damages up to $150,000 per infringement, as attorney’s fees and costs.

The Digital Millennium Copyright Act (DMCA) makes it a crime to create software that helps distribute copyrighted materials. It also limits an Internet Service Provider’s (ISP) liability if the ISP notifies the alleged infringer and suspends access to illegal copies of copyrighted materials. As an ISP, Loyola is required to comply with the DMCA.

What to Do About P2P

• 1)  Remove any copies that are running on any computers. This may take some time, and require some professional assistance.
• 2)  Do not allow P2P software Internet access. This may mean: Disable NAT – Network Address Translation; Block access to/from the common P2P ports; Use a packet-reassembly firewall that can examine streams of data in-context for possible P2P misuse.
• 3)  Delete any files on any machines which may have been obtained over a P2P network.

Legal Alternatives for Downloading

Some of the sites listed here, provide some or all content at no charge. They are funded by advertising or represent artists who want their material distributed for free. This list is not exhaustive of all content that is legally available. However, it will give you some legal options.

Movies: Watch movies online legally. Many of them are free->> Hulu Movies, Joost Movies, Amazon Video on Demand, Netflix, CinemaNow, Walmart Movies, BlockBuster

TV Shows: Watch TV shows online legally. Many of them are free->> Hulu TV, Joost TV, Clicker TV, Netflix TV, Walmart TV, iTunes TV

Music: Listen to music online legally. Many of them are free->> Pandora, Slacker, iLike, Music Rebellion, Last.fm, Blip.fm, Napster, Rhapsody, Yahoo Music Unlimited, iTunes Music, eMusic, AmieStreet, Mindawn, Zune

Others: ESPN3, GameFly, GameTap, Steam

For more legal websites click here

Students can also watch new movies on-demand while on campus: http://watchnow.reslife.com/loyolachicago/SDC/Content/Browse.aspx

What is identity theft?

Identity theft is a crime where a person uses your personal identification information, like your name, Social Security Number, driver’s license number or credit card number, without your permission with an intention to commit fraud. This also allows the criminal to steal money from you by opening up new credit card accounts and running up charges on them or purchasing new services like a phone account, internet, rent an apartment, etc. in your name. You may not even be able to find out about the theft until you review your credit card statement and notice charges you didn’t make or in some instances until you review your full credit report and credit history.

How is it harmful?

Identity theft can also provide a thief with false credentials for immigration or other applications. The biggest problem with identity theft is that the crimes committed by the thief are often attributed to the victim. The FTC (Federal Trade Commission) estimates that as many as 9 million Americans have their identities stolen each year. Identity theft is a serious crime and it can be harmful to the person whose identity is stolen by losing out on job opportunities, or denial of loans for education, housing or cars because of negative information on their credit reports. Aside from losing money and confidence in the marketplace, identity theft also soils the reputation and livelihood of the consumer. In few cases, they may even be arrested for crimes they did not commit. According to the FBI, identity theft is the fastest-growing white-collar crime in the United States.

What can one do if already a victim of Identity Theft?

1)     Place a fraud alert on your credit reports as and review them as fraud alert prevents an identity thief from opening more accounts in your name.

2)     Close the accounts that you suspect have been opened fraudulently immediately.

3)     File a complaint with the local police or with the Federal Trade Commission, which may help in recovering from identity theft more quickly.

How to avoid Identity theft?

To minimize the risk of becoming a victim of identity theft, remember the word SCAM:

S – Be stingy. Do not give your personal information to others unless you have a valid reason to trust them
C – always Check your financial information on a regular basis to track your financial status
A  – Ask for a copy of your credit report from time to time – you are entitled to 1 free report every year
M – Maintain careful records of your banking and other important financial accounts

What is the Gameover malware?

Gameover is an updated Zeus malware attack that goes after bank information.  The attack takes place when malicious users send spam email to infect computers with malware, which is designed to collect bank account information from the recipient’s computer.  After this malware is on your computer,  it is able to steal usernames, passwords and can bypass financial institutions’ user authentications.  As the name of the attack suggests, once the malware gets your information, it is “game over” for your bank account.

How it works

Spammers spread the virus to computers by sending out emails from the National Automated Clearing House Association (NACHA), the Federal Reserve Bank, or the Federal Deposit Insurance Corporation (FDIC) saying there is a problem with your bank account or recent transaction.  A link is provided in the email to fix the problem, which then leads you to a fake website. As soon as you click the link and go to the website you also just downloaded this malware to your computer.

How to protect yourself

NACHA, FDIC, and the Federal Reserve all say they don’t send out unsolicited emails to bank account holders. So if you want to confirm there’s a problem with your account or one of your recent transactions, contact your financial institution. Do not click on any links sent via email, as these may take you to a Web site that places malicious software on your computer. Instead, enter the address that you know is legitimate into your browser. For example: Instead of clicking on the URL received in an email (such as http://www.123citi-bank-usa.com/update/yourcredentials.html), open up Firefox and navigate to Citibank’s known website: www.citibank.com.

Where can I find more info?
Visit http://www.luc.edu/uiso/protect_yourself.shtml for additional security tips.

Firesheep is a Firefox extension that basically allows anyone you are sharing a wireless network with to discover and access certain online sessions that you are logged into. Many sites encrypt information only for your initial log in; once you successfully log in, the server (that hosts the website you are accessing) sends your browser a cookie granting you access. Once you are logged in, the site reverts back to an unencrypted transmission. Firesheep allows other users to access someone else’s cookies and enter websites using that login information.

To effectively combat Firesheep, you can download one of several plug-ins for Firefox that will force a webpage to use a secure web connection. However, in order for this work, the website must support full end-to-end encryption (either as HTTPS or SSL). For more information and to learn how to install one of these plug-ins, visit the University Information Security Office page.

Did You Know?
Loyola University Chicago blocks over one million spam messages per day.

What is Phishing?
Phishing is an attempt to steal sensitive information, such as your social security number or passwords, by posing as a trusted organization or person. Phishers are known for using this information for identity theft and other fraudulent acts.

What do Phishing attacks look like?
Phishing is most commonly attempted via an email that will claim to come from a trusted organization, such as Loyola University Chicago, your bank or your credit card company. There are two common mechanisms that phishers use to steal your sensitive information:

• 1.  They will ask you to respond to an email with your sensitive  information.
• 2.  They will ask you to follow links to update your sensitive  information.
  • a.  You will appear to be providing your information to the trusted company, while in fact you will be providing that information to a phisher.

What are some types of Phishing attacks?

• “Spear Phishing” targets a particular person or organization into revealing confidential company information by impersonating the organization, or members of the organization.
• “Whaling” specifically targets senior management into divulging confidential information.

How can I prevent becoming a victim of Phishing attacks?
No legitimate organization will ever ask you for your password!

Do not click on any links sent via email, as these may take you to a web site that places malicious software on your computer. Instead, enter the address that you know is legitimate into your browser.

For example:  Instead of clicking on the URL received in an email (such as http://www.123citi-bank-usa.com/update/yourcredentials.html), open up Firefox and navigate to Citibank’s known website: www.citibank.com.

Call the institution to inquire on the matter instead of following the link. In addition, refrain from calling any numbers listed in the email, and instead, use a number for the organization that you know is legitimate.

If you are prompted to enter your username and password to a site that appears legitimate, enter both incorrectly.  A fraudulent site will accept the incorrect username and password while a legitimate site will not. Also make sure to check that the SSL certificate is valid and error free. Refer to the following link and steps to validate the sites SSL certificate, http://info.ssl.com/article.aspx?id=10068.

If you do provide personal or sensitive information to a malicious site, immediately contact the appropriate institution with the details surrounding the occurrence.

Where can I send potential Phishing attacks to be processed?
LUC Staff, faculty, and students should report any regular phishing emails or sites to spam@mailfoundry.com.

If you have received a Spear Phishing or Whaling attack, please forward it to DataSecurity@luc.edu.

Where can I find more info?
Visit http://www.luc.edu/uiso/protect_yourself.shtml for additional security tips.

Does this scenario sound familiar?

It’s time again for you to change your Loyola password and due to the password complexity requirements, you end up creating a password with a string of numbers and letters that’s impossible to remember.  Each time you need your Loyola password you find yourself reaching for that sticky note that you hid in your desk drawer.

Now compound that with 10 more accounts and 10 more passwords for each account.  Suddenly you have a memory nightmare!

If you have more than one username and password it can be a struggle to manage your login information securely. For this week’s Tech Tip, The University Information Security Office (UISO) provides you with information and resources to help you manage all of your passwords.

What are Password Vault Technologies?

Password Vault Technologies allow you to store all of your user names and passwords in one securely encrypted database.

Why should I use a Password Vault?

• -It allows you to use stronger passwords that are not easy to remember, especially as password complexity rules become stricter.

• -No more needing to set all your accounts to the same username and password.
• -It requires you to only have to remember one master password.
• -It will keep you from having to write down passwords which are easy to lose or have fall into the wrong hands.

How does a Password Vault keep you safe?

You can put all your passwords for your accounts in one database, which is locked with one master key. You only have to remember one single master password to unlock the whole database. The database is encrypted using best and most secure encryption algorithms, so you can be assured it will not be broken into.

The password vault technologies come with these features:

• -Database Encryption- Encrypts the complete database, not just your passwords. User names, notes and other data are encrypted too.
• -Protection against guessing and dictionary attacks- These technologies have anti-brute forcing protections built in to the product.  However, be sure to select a good master password!  Any easy-to-guess password will expose all of your credentials.

Which Password Vault product should I use?

The UISO recommends the following Password Vault technologies, which are both open source and free:

• -KeePass: – http://www.keepass.info/download.html
  
• -Password Safe: – http://passwordsafe.sourceforge.net/downloads.shtml

If you have a Microsoft Word 2007 document that you would like to make read-only or if you would like to add password protection, Word offers a few options to secure your file. Here are a few security features offered in Word:

Encrypt Document: Adding encryption to your document will require that a password be entered to open the document. To encrypt your document, click on the Microsoft Icon > Prepare > Encrypt Document. A dialog box will prompt you to set a password.

Read-only Document: You can set your document to be read-only and additionally set a password to open or modify the document. To access these options, click on the Microsoft Icon > Save As, then in the bottom left corner, click on Tools > General Options.

A dialog box will open and you can choose to make the document read-only and to add a password to open and/or a password to modify. Click OK once you have made changes.

When the file is opened, a dialog box will prompt users to enter the password. Keep in mind that if users open the file as a read-only document, they will be able to edit and save as a new document.

Mark as Final: If you want your file to be read-only, you can also mark the document as final. This will disable editing and typing tools. To do this click on the Microsoft Icon > Prepare > Mark as Final. If you decide to open it later for editing, you can select Mark as Final again to set the document to the normal mode.

Note: If you lose or forget any passwords, they cannot be recovered.

In order to keep your computer’s operating system running safely and efficiently, it is important that you regularly install the latest software patches and updates.  In this week’s Tech Tip, the Loyola University Information Security Office provides information and resources to help you keep your software up-to-date.

What is Patch Tuesday?
Patch Tuesday refers to the second Tuesday of each month when Microsoft releases fixes for known issues in its operating systems and other products. These fixes are called patches or updates and are available for free download from the Microsoft website for any legally licensed copy of Microsoft Software.

What do patches do?
After software gets released to the public and it is being used with a greater frequency, people may begin to notice small problems that were not found during testing. Also, old software may have compatibility issues with newer hardware and new software might not run properly on older hardware. After gathering this data, these patches are released to fix these problems.

Why should I care about patches?
Software patches and updates don’t just fix small problems; they can also fix serious security issues within specific software programs. Malicious users can exploit vulnerabilities in software to gain access to part or all of your system. By keeping your software up to date, you are making it harder for someone to gain unauthorized access to your system.

How can I keep my software up to date?
The best way to keep software up to date is to regularly check and install updates from the software company. Microsoft has an update feature built into its operating systems and software which, when turned on, will automatically check with Microsoft for updates. Here at Loyola, computers in the labs, classrooms, as well as faculty/staff desktop PCs, are monitored by network software. Updates are sent to them from a main server once the update has been tested and approved by our Desktop Services team. Students who bring their own computers to campus are required the keep their operating system and antivirus solution up to date. Otherwise, they will not be able to gain access to the Loyola network.

It is also important to keep your other applications up to date. They can have security vulnerabilities that can be exploited by malicious users to gain access to your system. Some applications may have options to turn on automatic updates, but if not, it is important that you check for updates regularly. Here is list of popular software and links to the update site:

Windows:   http://update.microsoft.com
OS X:  http://www.apple.com/support/osfamily
PC Office:  http://office.microsoft.com/officeupdate              
Mac Office:   http://www.microsoft.com/mac/downloads.mspx
iPhone/iPod:  http://www.apple.com/support
Adobe:   http://www.adobe.com/support/downloads/new.jsp
Firefox:  http://www.mozilla.com/en-US/firefox/upgrade.html
Safari:   http://www.apple.com/safari/download
Opera:  http://www.opera.com/download
Norton:  http://www.symantec.com/norton/downloads/index.jsp
McAfee:  http://www.mcafee.com/us/downloads