BOFH (W3)

...
The Register is the online newspaper for the global tech workforce. It reaches millions of IT Professionals across the globe each month. Our readers value our output and our unique view of the industry - that's why they keep coming back for more.

comparitech.com
Internet Security Guide

The jargon-free guide to computer and internet security

Published by Jon Watson on October 28, 2017 in Information Security

Improve your computer and internet security with these simple steps that anyone can implement.

The internet is truly a mind boggling thing. It is a global network of computers all hooked together sharing information. It has been marketed as a system whereby we visit web sites and log on to other systems in order to make it understandable. The reality of how the internet works is fundamentally different than those terms lead us to believe. In the gaps between the notion and reality of how the internet works is where security and safety problems lie. In this article we’ll break out the most important aspects of internet safety into bite-sized chunks and offer some practical advice on each.

Contents

• 1 Passwords: how to create and protect them
• 1.1 Creating good passwords
• 1.2 Using password managers
• 1.3 Using two-factor authentication (2FA)
• 2 How to identify unsafe sites
• 2.1 HTTPS/SSL - what does it mean?
• 2.2 Google Safe Browsing warnings
• 2.3 Be skeptical of links and attachments
• 3 How to use Public Wifi
• 3.1 Don’t use public wifi for sensitive transactions
• 3.2 Use a Virtual Private Network (VPN)
• 3.3 Use two-factor authentication (2FA) on your accounts
• 4 How to avoid and fix identify theft
• 4.1 Signs of identify theft
• 4.2 What to do if your identity has been stolen
• 5 Detecting and fixing malware infections
• 5.1 Signs of malware infection
• 5.2 What to do if your system becomes infected with malware
• 6 What to do if your online account has been hacked
• 6.1 Signs of a compromised online account
• 6.2 Steps to be taken post-hack
• 7 System management
• 7.1 Keeping your system up to date
• 7.2 Backing up your data
• 7.3 Antivirus/Security programs
• 8 Social media use
• 8.1 What you should not share
• 8.2 How to implement basic privacy on Facebook

curfew (W1)

Dummy (W3)

Enigma Variationen
Dorabella Chiffre (W2)

One of the more often heard guesses is that it is the British national anthem, "God Save the King". Music scholars believe it may be from Mozart's "Prague" Symphony, which was on the program at the "Enigma" Variations' premiere in 1899. In the opinion of others, the unheard theme is actually a countermelody to some other tune - in other words it would fit in with it, but does not necessarily contain any of its characteristics other than the most general harmonic outline.

gaffe
gaffen
faire gaffe
gaffer
Gaston Lagaffe
Mind the Gaffe
language gaffe
Gaffel
Gaffelherr
gabelle
gabelou (W3)

14. September 1396 - Verfassung für Köln
...
Am 14. September 1396 wurde die Macht innerhalb des (Kölner) Stadtregiments neu verteilt. An diesem Tag nämlich verkündeten der „burgemeystere und rait der stat van Coelne“ eine neue Verfassung, niedergelegt im sogenannten Verbundbrief. Diese Urkunde kodifizierte die in den Wochen zuvor vollzogene Umwälzung in der Stadt. Im Kern enthielt die neue Verfassung den Übergang der städtischen Gewalt von den patrizischen Geschlechtern auf die 22 "Gaffeln". In diesen politischen Korporationen, die auf den Zünften basierten, hatten sich die aufstrebenden Handwerker und Kaufleute zusammengefunden.
...

...
"Gaffe" is probably related to "gab" (= "Geschwätz") meaning loud, senseless talk or gossip. Thus by the early 19th century the expression "to blow the gaff" meant "to let out a secret", "to reveal a plot". That would, obviously, be an embarrassing mistake, so you can see how it could develop into "gaffe" meaning "public or social mistake".
...

modulus 10 (W3)

The "LUHN formula", also called "modulus 10", is a simple algorithm used to validate the number on a credit card. It works on cards issued by all the major credit card companies, including American Express, Visa, Master Card, Discover, and Diner's Club. Originally created by a group of mathematicians in the 1960s, the "LUHN formula" is in the public domain, and anyone can use it.

The word modulus has several different meanings in mathematics with respect to complex numbers, congruences, elliptic integrals, quadratic invariants, sets, etc.
...
SEE ALSO: "Complex Modulus", "Congruence", "Elliptic Modulus", "Quadratic Invariant Modulus", "Set Modulus"

mways - Protect email addresses in web pages

...
(Version 2.1)
This page will generate a HTML encoded mailto link that is reasonably "spambot" proof. Spambots crawl over websites looking for email addresses, when they find one they add it to their database for junk email.
...

Phony
Phoney (W3)

pretexting (W3)

• "Pretexting": new? Wilson Gray
• "Pretexting": new? Arnold M. Zwicky
• "Pretexting": new? Erik Hoover
• "Pretexting": new? Benjamin Zimmer
• "Pretexting": new? Baker, John

"Pretexting" [main stress on the first syllable?] is the practice of pretending to be someone else in order to obtain personal information on a person, such as telephone or banking records.

"Pretexting" ist eine Form von Social Engineering, mit der die Angreifer ihre Opfer dazu bewegen wollen, freiwillig wertvolle Informationen wie etwa Zugangsdaten preiszugeben. Das Alleinstellungsmerkmal von Pretexting ist seine kreative Komponente: Der Angreifer versucht ein frei erfundenes Szenario, beziehungsweise einen falschen Vorwand ("Pretext") zu nutzen, um sein Gegenüber zu überlisten. Dabei übernimmt der Angreifer im Regelfall die Rolle einer Autoritätsperson, die vermeintlich alle Rechte besitzt, auf die betreffenden Informationen zuzugreifen oder die der "helfenden Hand", die das Opfer "unterstützen" will.

"Pretexting" hat seine Wurzeln im britischen Boulevard-Journalismus: Die Taktiken wurden von Klatschblättern genutzt, um möglichst skandalhaltige News über Prominente und Politiker verbreiten zu können. Heutzutage ist Pretexting ein beliebtes Werkzeug unter Scammern und anderen Cyberkriminellen, um Einzelpersonen oder Unternehmen zu kompromittieren. Besonders interessant sind für die Angreifer dabei persönliche Daten und finanzielle Informationen.
...

Beim Pretexting besorgt sich jemand unter Vorspiegelung einer fremden Identität Informationen eines Dritten, zum Beispiel Rechnungen, die sensible Daten enthalten.

Pretexting - Informationsdiebstahl mit Vorwand

Lukas Böhl, 24.01.2020 - 07:50 Uhr

Als Identitätsdiebstahl (auch Identitätsbetrug, Identitätsmissbrauch; englisch identity theft) wird die missbräuchliche Nutzung personenbezogener Daten (der Identität) einer natürlichen Person durch Dritte bezeichnet.
...

"Pretexting" is a type of social engineering attack that involves a situation, or pretext, created by an attacker in order to lure a victim into a vulnerable situation and to trick them into giving private information, specifically information that the victim would typically not give outside the context of the pretext. In its history, pretexting has been described as the first stage of social engineering, and has been used by the FBI to aid in investigations. A specific example of pretexting is reverse social engineering, in which the attacker tricks the victim into contacting the attacker first.
...
Early pretexting (1970-80s)
...

Neue Wörter vom 09.10.2006

Pretexting, das

So wirft der renommierte Venture-Capitalist und ehemalige Kontrolleur Thomas Perkins HP vor, Telefonate von AR-Mitgliedern abgehört zu haben. Aus diesem Grund gab Perkins sein Aufsichtsratsmandat im Mai dieses Jahres auf der Stelle auf. Der Technologiekonzern bestätigte lediglich, dass Ermittlungsbüros beauftragt worden seien, die unter Angabe einer falschen Identität beispielsweise bei Telefonunternehmen Informationen wie getätigte und empfangene Telefongespräche von ihren AR-Mitgliedern erfragen haben.

Dieses Vorgehen, "Pretexting" genannt, ist nicht illegal, dürfte sich aber kaum vorteilhaft auf die ohnehin seit langem angespannte Stimmung im HP-Gremium auswirken. Der Konzern verneint, dass Telefongespräche der Aufsichtsratsmitglieder aufgezeichnet oder abgehört worden sind. Das kalifornische Justizministerium hat nun laut HP Informationen angefordert. Überdies fragt die SEC beim Drucker- und Computerhersteller weitere Ausführungen zu Perkins Rücktritt ab.

http://www.ftd.de/karriere_management/koepfe/110973.html

RACF (W3)

• Abuse.net
• Fluid Dynamics MX record lookup
• IANA
• IETF RFC
• List of port numbers
• Nominet.uk
• Port numbers well-known trojans use Sans
• Lookup port numbers fishnetsecurity
• WinSock Development Information sockets.com
• RFC 1700 Assigned Numbers
• RFC editor
• World Wide Web Consortium (W3C)
• W3C Link Checker

• Security - IBM OS390
• CBT Tape
• Geoff Rousell's GSE Info
• Goldis Consulting
• GSE - United Kingdom
• HG - Henderson Group
• IBM BookManager® BookServer Library
• IBM OS390 New
• IBM Redbooks - Home Page
• IBM Security Planning Wizard
• ICETOOL Paper
• Mainframe Week
• Primeur (MQ security)
• RACF home page
• RACF-L website
• RACF Presentations - not just RACF - recommeded!
• Rex Swain's REXX Summary
• Steve Neeland's sample ICETOOL reports
• The RACF PassTicket Page
• Thierry FALISSARD's home page
• Thierry's Top Ten
• Go2Vanguard list
• Xephon - RACF Update

Ransomware (W3)

ransom (n.)
c.1200, "sum paid for the release of a prisoner or captured man," from Old French ranson (Modern French rançon), earlier raenson "ransom, redemption," from Latin redemptionem (nominative redemptio) "a redeeming," from redimere (see redeem).

Ransomware is a type of malware that prevents or limits users from accessing their system. To make the infected system usable again, the victim is forced to pay (a ransom) to a remote threat actor thru certain online payment methods.

Users may encounter this threat through different means. They can either download ransomware unwittingly by visiting malicious or compromised websites. It can also arrive as a payload, either dropped or downloaded by other malware.

It is important to note, however, that paying for the ransom does not guarantee that users can eventually access the infected system.
...
"Ransomware" is considered a "scareware", as it forces users to pay for a fee (or ransom) by scaring or intimidating them. In this sense, it is similar to the FAKEAV malware, though using a different tactic. Instead of capturing the infected system or encrypting files, FAKEAV coax users into purchasing their bogus antimalware software by showing fake antimalware scanning results.

HISTORY

Early Years

First cases of ransomware infection were seen between the years 2005 - 2006 in Russia. We first reported this incident back in 2006, in which a ransomware variant (detected as TROJ_CRYZIP.A) zipped certain file types and overwrites these, thus leaving only the password-protected zip files in the user’s system. It also created a notepad, which poses as the ransom note to inform users that they can retrieve their files in exchange for $300.
...
Ransomware infection was initially limited to Russia. But its popularity and profitable business model soon found its way in other countries across Europe. By March 2012, we have noticed the continuous spread of ransomware infection across Europe (and the United States, Canda).
...
The Rise of Reveton or Police Ransomware
...
What Can Users Do?
...
Latest Notable Ransomware
...

under the rose (W2)

"Under the rose" = "privately" or "secretly". The rose was, it is said, sacred to Harpocrates, the God of silence, and therefore frequently placed in the ceilings of rooms destined for the receiving of guests; implying, that whatever was transacted there, should not be made public.

...
Now to the root of sub rosa. The rose is a key symbol in Brown's plot. His hero says: "The Romans hung a rose over meetings to indicate the meeting was confidential. Attendees understood that whatever was said under the rose - or sub rosa - had to remain a secret."

I don't know why the novelist attributes it to the Romans. Earliest citation is in Henry VIII's 1546 State Papers, which in modern English reads, "The said questions were asked with license, and should remain under the rose ... no more to be rehearsed."

In the 1960 Folklore and Symbolism of Flowers, Plants and Trees, Ernst and Johanna Lehner tell how Aphrodite (you remember Hermes' girlfriend) presented a rose to her son, Eros, god of love: "When Eros in turn gave the rose to Harpocrates, the deity of silence, to induce him to conceal the weaknesses of the gods, the rose became the emblem of silence and secrecy. In ancient times a rose was attached to the ceiling of council chambers as an indication that everybody present was sworn to secrecy, sub rosa - under the rose."
...

Anderson, Ross
Security Engineering
A Guide to Building Dependable Distributed Systems

• foreword, written by Bruce Schneier.
• table of contents.
• a sample chapter (chapter 10) on the protection of burglar alarms and other monitoring systems.
• another sample chapter (chapter 18) on network attack and defense.
• You can read chapter 1 and part of chapter 2 as excerpts on Amazon (though the graphics quality here has been deliberately downgraded).
• bibliography