Top 5 Considerations for Secure Wireless Email
683583
(Source: Sybase)  Choosing a wireless email solution? Learn the top IT considerations for security and compliance before you buy.
374793
Wireless security threats are overhyped and easily stopped. You have bigger things to worry about, says a Computerworld editor.
76351
If you use a secure wireless network, hackers may be able to steal data from your computer in the time it takes to have a cup of coffee.At the Toorcon hacking conference in San Diego this coming weekend, security researcher Vivek Ramachandran, will demonstrate a technique he&#39;s developed to attack laptops that use the WEP encryption system to log on to secure wireless networks.Developed in the late 1990s, WEP was the default method of securing Wi-Fi networks. Though the WPA (Wi-Fi Protected Access) system replaced it, about 41 percent of businesses continue to use WEP. That percentage is even higher among home users, security experts say.That&#39;s unfortunate because WEP has been riddled with security problems. In fact, WEP was blamed for the recent&#160;TJX Companies data breach&#160;in which thieves were able to access 45 million credit- and debit-card numbers.To date, however, researchers have tended to focus on exploiting WEP flaws in order to break into wireless networks. That generally meant that the attacker would roll up near the WEP-encrypted router, crack the WEP key used to encrypt network traffic, and then log on to the network.Ramachandran, a senior wireless security researcher with AirTight Networks, has taken a look at the client side of things and developed a way of tricking a WEP-enabled client into thinking that it is logging on to a network that it already knows.His technique, which he calls the Cafe Latte attack, allows an attacker to circumvent firewall protection and attack the laptop or to set up a &quot;man in the middle&quot; attack and snoop on the victim&#39;s online activity. &quot;Until now, the conventional belief was that in order to crack WEP, the attacker had to show up at the parking lot,&quot; he said. &quot;With the discovery of our attack, every employee of an organization is the target of an attack.&quot;There are several steps to Cafe Latte, all of which exploit known flaws in the WEP architecture. First, the attacker programs a laptop computer to act like a malicious wireless network, setting up shop in an Internet cafe or an airport. The malicious PC then begins communicating with other Wi-Fi laptops in range, figuring out the name of the WEP-enabled routers that these laptops are programmed to look for and then cracks the keystream encryption code required to send messages to the victim&#39;s laptop.Knowing the keystream only gets the attacker halfway. To truly crack the WEP encryption key and read messages coming from the victim, the attacker must somehow trick the victim into sending a large amount of information -- about 70,000 messages, actually -- to the malicious network. Those messages could then be analyzed and cracked using WEP-cracking tools.Cafe Latte does this by taking advantage of the way the Internet&#39;s ARP (Address Resolution Protocol) ensures that two computers do not share the same IP address. ARP is used when a new computer joins a LAN to announce the IP address it will be using and to ensure that no other machine shares that address. These network messages are ignored by the victim&#39;s PC unless it shares that address. Then it sends a message back to the attacker&#39;s PC saying that the IP address in question is already being used.Once the attacker gets a response from the victim&#39;s PC, he knows he has guessed the correct IP address and he can bombard the victim&#39;s PC with the same message, essentially saying over and over again &quot;I&#39;m joining the network and I&#39;d like to use this IP address. Are you already using it?&quot;As the victim&#39;s laptop continues to reply, &quot;Yes, I am,&quot; the attacker eventually stores up enough samples of encrypted messages to be able to figure out the WEP key. Now messages from the victim can be read by the attacker.&quot;It&#39;s definitely a novel attack,&quot; said Jon Ellch, a Wi-Fi security researcher who also goes by the name johnny cache. While an attacker could use this WEP key to log on to the victim&#39;s WEP network, the real danger here is from the man-in-the-middle attack, which would let the attacker see everything the victim is doing on the Internet, he added.Still, a victim might notice that something was up during the estimated 30 minutes that Cafe Latte requires in order to crack the WEP key, Ellch said. The attack would have a better chance of succeeding if the laptop were simply turned on and trying to connect to the Wi-Fi network in the background, he said. &quot;If they&#39;re trying to do something with the Internet, obviously it&#39;s not going to pan out so well.&quot;Toorcon runs from Friday to Sunday.
458947
(InfoWorld) - The biggest threat to your personal and professional security may be the information that your computer is already transmitting to the world around you. Data leakage might be a hot topic, given the list of high-profile incidents reported by businesses such as TJX Companies -- through which reams of detailed consumer records have been exposed -- but most people are already broadcasting enough information from their laptops to allow hackers to aim targeted attacks at their devices and corporate networks, according to security researchers. In a presentation at the ongoing Black Hat DC 2007 conference being held in Washington, DC, from Feb. 28 to Mar. 1, experts with Atlanta-based services provider Errata Security outlined a trend they've labeled as "data seepage." The concept is based on the idea that people using Wi-Fi systems to connect their computers to the Web in public settings such as airport lounges or coffee shops are handing out enough personal clues to give attackers plenty of ammunition to make them the target of their malware or hacks. Using a software application they have designed dubbed Ferret, Errata chief executive Robert Graham and chief technology officer Dave Maynor demonstrated how easy it is to intercept seemingly innocuous information from people's devices as they connect to the Internet. They can then take that data to create a detailed profile of the individual, their Web usage, and even their employers' IT networks. During the course of their presentation, the security experts were even able to use Ferret to intercept an e-mail sent to a reporter working in another conference session that included one of her applications' passwords. Whenever a user connects to the Web via Wi-Fi, or even if their laptop's wireless systems are merely left turned on, someone using such a so-called sniffing tool can garner data about where the user has traveled, what type of operating system or applications they use, and who they may work for, Graham said. For instance, the expert said that while sitting in airlines' business customer lounges it's not hard to look at details offered up freely by the machines of other travelers using Wi-Fi. In doing so, Ferret can detect what hotspots the person has been through, giving an idea of their physical location; determine what e-mail servers or IM systems they attempt to access, lending an idea of their software and potentially their employer; and even scoop their IM contacts to determine who they communicate with. "With seepage, we're talking about the distribution information that you actually mean to broadcast but which hackers can take and exploit for their own needs," Graham said. "All you have to do is turn on your computer and we can tell a lot about you." For instance, computers made by Apple offer up details of what operating system someone is using when they turn their machines on or access Wi-Fi. If captured by a hacker, this could allow them to target specific malware attacks at the individual based on any known vulnerabilities in their version of the OS. In addition to data related to Web connectivity or operating systems, such tools can be used to detect what types of anti-virus applications users are running when the software programs attempt to automatically download updates. With the wide number of known vulnerabilities existing in anti-virus programs, a hacker could easily take that information and use it to craft a targeted attack, the experts said. The tools can even be used to garner similar data from smartphones and other data-centric handhelds, according to the researchers. The experts contend that when the U.S. government was piecing together information about suspected terrorists after the Sept. 11 attacks, investigators likely relied on the same types of data to figure out where various people had traveled, who they communicated with, and what they might have been looking at on the Internet. Consumers may be upset about retailers who collect and expose sensitive information or unchecked government wiretaps, but they are unknowingly handing over a range of data that could be used to track their movements, steal their money, or penetrate their employers' networks. "Just by going to a lounge in an airport with a sniffer like this, you can easily develop a profile that can be used to exploit any weaknesses," Graham said. "You can move from [intercepting] a low-level MAC address to capturing high-level information in a very short amount of time." To help people understand just how much information can be gathered using sniffers like Ferret, Errata is posting the source code for the tool on its Web site so that developers can try it for themselves. The best advice that the security experts offered to end-users to protect themselves is to use personal firewalls and VPNs to cloak as much of their information and activity as possible. "It's not single pieces of information that we're warning about, it's the collection of pieces of data that offer detailed information about who you are," Maynor said. "If the government were collecting this information people would be up in arms, but as it is, they are already giving it away without a second thought."
337372
Wireless networks giving computer users  Internet access from anywhere in the home could expose them to  eavesdropping and programmers should make their security  software easier to use, researchers say.
412243
(Source: Palm) This paper describes the key issues a multi-national enterprise needs to consider when determining the requirements for deploying a global wireless messaging project. The paper also describes how the Good Mobile Messaging solution addresses those key issues, and finally, provides two case studies of recent Good Technology customer deployments.
98560
Carriers and other service providers are poised to give consumers cheap, easy access to personal e-mail on their regular phones.
23770
Mobile e-mail device for business travelers extending its reach.
196852
Managing email and protecting it from spam, phishing, and spyware is critical.  Learn to guard against them today- and tomorrow- with a sophisticated, hardened security appliance that processes mail 10x as efficiently as standard Unix systems.
112205
Software update patches bug in wireless drivers that left systems vulnerable.
229644
Services try different approaches to sender authentication to halt spam.
549784
(Source: MessageLabs) It is possible to stop almost every unsolicited email from reaching your network. Outsourcing to a managed anti-spam service, such as MessageLabs, can provide the most cost-effective way of protecting your business against all spam threats.
602929
(Source: Symantec) Join this webcast to learn how you can maximize uptime of your e-mail infrastructure, dynamically manage storage growth without impacting user performance, quickly recover from data or application failure, and protect from the worst case - a complete site disaster.
87414
A few of my previous columns discussed my vision of creating a more secure Internet. It involved replacing the Internet's default anonymity with pervasive authentication, from the hardware initialization, through the OS and all applications, the user, and ending with a verifiable network stream. It is my strong belief that without a complete overhaul of default authentication, malicious hacking is going to continue indefinitely.
540558
The ZoneAlarm Secure Wireless Router Z100G includes all the software needed to help protect your home network from intrusions.
525138
Email is your business's lifelineand its worst security nightmare. Learn the 5 critical steps you can take to stop spam and viruses, ensure compliance, and protect your corporate identity.
539362
Only Salesforce standing In the morass of Web 2.0 insecurity, Gmail and other Google-hosted services stood out as a beacon of hope. That's because they were believed to be the only free destination that offered protection against a decade-old vulnerability that enabled hackers to steal sensitive authentication details as they pass over Wi-Fi hotspots and other types of public networks.â¦