Monday, October 26, 2009

Windows 7: Inside Multitouch

 

Friendly Computers have seen touch screens before, so what makes the ones supported by Windows 7 so special? Below is the inside scoop.

Touch screen technology may seem shiny and new but any analyst will tell you that it has been around for decades: ATMs, grocery store self-check kiosks, even museum exhibits. But what makes Windows 7 so exciting is that no computer operating system ever incorporated native support for multitouch before. The new breed of multitouch laptops and desktops with touch screens don't need extra downloads or plugins-- multitouch just works.

Multitouch's Predecessors

To be fair, Windows 7 is not the first operating system to support some form of touch computing. Vista offered single-touch capabilities in tablet mode, and pen input is quite common as well. But as much as Microsoft would love to paint multitouch as a natural progression in its operating systems, its Apple that was the real democratizer of multiple-input touch screens. Introducing now familiar gestures like pinching, tapping, and flicking, the iPhone and the iPod Touch, made multitouch second nature to many users. Apple followed up its mobile devices with gesture-based touchpads on its MacBook and MacBook Pro models in late 2008. Though it was a bit tough to get used to the integrated mouse button and touchpad, the ability to use gestures based on up to four fingers opened up new possibilities.

A few Windows-based "multitouch" systems have come out as well—namely the HP TouchSmart TX2 and Dell Latitude XT line of laptops, as well as the HP TouchSmart desktop PCs. These systems used built-in hardware and software solutions to accommodate two-finger touch (though they still couldn't support three- and four-finger gestures). But it wasn't until early glimpses at Windows 7 this year that we saw Microsoft itself respond to the multitouch trend.

How Multitouch Works

A few months before those MacBooks hit the scene, Microsoft announced its plans for multitouch at the All Things Digital conference in California. Unlike any of its predecessors, Windows 7 natively supports multitouch functionality in touch screens and is built to accommodate up to 10 points of contact. On the Engineering Windows 7 blog, the developers highlight all the ways the OS was tweaked to optimize it for touch. It's everything from making keys on the on-screen keyboard glow when your finger is covering the letter to improving high dpi support to make small links and buttons easier to access with touch.

Though the software is similar across platforms, the PCs we've tested use different hardware solutions. The multitouch laptops we've seen so far, like the Lenovo ThinkPad X200 Tablet and Fujitsu LifeBook T5010 use dual-active digitizers, meaning they have one technology for the stylus and another, called capacitive, is activated for multitouch using your fingers. Non-tablets like the Lenovo ThinkPad T400s use a capacitive touch screen only, and many more will follow this implementation (Toshiba and Acer have already announced capacitive touch panels on their mainstream laptops).

In capacitive screens, a small current of electricity runs across the surface, with circuits at the corners. Touching the screen interrupts that current. Capacitive technology only works on smaller screens, so desktops like the HP TouchSmart 600-1055 PC and Gateway One ZX6810-01 employ optical solutions. Optical sensors are set up around the screen creating a grid. The screen reacts when your finger, pen, stylus, or any other implement break one of the beams; you don't actually have to physically touch the surface to get a response.

All of the PC manufacturers that have put out multitouch systems so far have included Windows 7's Touch Pack, a software suite that incorporates applications that work with the Windows 7 kernel to use a multitude of different gestures. For instance, Microsoft Surface Collage lets you access and manipulate all your photos to create different designs on the screen. You can drag and drop images with one motion, resize or rotate them with two fingers, and scroll through the images available on the bottom pane using the flicking motion. Other games and applications like BlackBoard and Microsoft Surface Lagoon act like tutorials for multitouch, creating objectives that force you to perfect various gestures in order to win the games.

What's Next for Multitouch

Although the Windows 7 Touch Pack certainly has that gee whiz factor, the real question regards implementations for multitouch in the future. Will it change the user experience? And can we harness that potential to take it beyond a neat trick for games and fun apps? Clearly the onus right now is on software makers to come up with revolutionary ways to integrate multitouch and expand its possibilities. Some PC manufacturers have included programs built around multitouch, like Gateway's TouchPortal and HP's TouchSmart interface. While HP's includes extra functionality like Hulu desktop and HP games, these still don't bring much more to the table than a new way to interact with Microsoft's existing touch-based programs.

Whether its niche markets like education, health care, and engineering finding new uses for multitouch, or multitouch making its way onto new platforms like netbooks, there's no question that this interface can change the way we look at computing. The Engineering Windows 7 blog sums its effect up well. In it, Steven Sinofsky, the president of the Windows division wrote, "One of my favorite experiences recently was watching folks at a computer retailer experience one of the currently available all-in-one touch desktops and then moving to another all-in-one and continuing to interact with the screen—except the PC was not interacting back. The notion that you can touch a screen seems to be becoming second nature."

For a closer look at some of the emerging Windows 7 multitouch systems, be sure to read our full reviews.

 

 

Source: http://www.pcmag.com/article2/0,2817,2354680,00.asp

Friday, October 23, 2009

Magic Mouse: Oh my God—it's full of capacitive sensors!

 

Friendly Computers thought you would enjoy an inside view of the new Mac Magic Mouse and Screen.

 

Magic Mouse: Oh my God—it's full of capacitive sensors!

iFixit

You thought iFixit was going to gut the new unibody white MacBook and call it a day? Oh no—it has vivisected Apple's new Magic Mouse to see just how the "magic" happens. The gang also went ahead and disassembled the 27" iMac that came with it, too.

The first thing that iFixit discovered is that Apple really does not want you to take the Magic Mouse apart. The whole thing is held together with some really tough glue instead of screws, or clips, or anything that might make it easier to take apart and put back together. Once apart, though, iFixit verified that the entire top surface is literally covered in capacitive touch sensors—138 in all—just as Apple promised. This is what allows the multitouch gestures to be so accurate and specific over such a small surface—though it would be nice if Apple enabled pinch-to-zoom and two-finger rotate.

Though the mouse has an aluminum base, the total aluminum content weighs just 10 grams. "That's compared to 37 grams of plastic and 47 grams of batteries," according to iFixit. "Nearly half the mouse's weight comes from the two AA batteries."

The diminutive circuit and electronic components do contribute a few grams to the overall light weight of the Magic Mouse. Part of what makes the circuit so small is a Broadcom BCM2042A4KFBGH, part of the BCM2042 family of chips that integrate keyboard and mouse controller functions with an HID profile and full Bluetooth communications stack. Broadcom brags that the chip allows wireless input devices to "approach the price points of legacy-wired mice and keyboards," but this is Apple here—paying a slight premium for a "better" mouse is par for the course. Besides, what is the standard price for a wired multitouch mouse? (Answer: there isn't one!)

Of course, after discovering all the magic Apple could stuff into a $69 mouse, though, you can hardly blame iFixit for "taking apart the iMac that came with our Magic Mouse." The new 27" iMac (the lower-end Core 2 Duo version) isn't radically different that the 24" iMac model that preceded it. However, iFixit did turn up a few interesting details.

27" iMac disassembled

iFixit

One nice addition is that Apple has doubled the amount of RAM slots; when stuffed with 4GB SO-DIMMs, you can have a total of 16GB of RAM. The new model also eliminates the 4mm aluminum bezel around the display glass cover—it goes all the way to the top and side edges, giving it a slightly cleaner appearance. The DisplayPort connection isn't wired up to allow the display to be powered separately when using the promised external source display functionality, though—the whole machine will have to be powered on for it to work.

A couple other notable discoveries: the power supply is 310W, the largest on any iMac; the SuperDrive is 12.5mm height, so it could be swapped for a Blu-ray drive if Apple ever gets over that bag of hurt; because the new back is all aluminum, the plastic Apple logo now serves as the only way for WiFi signals to get in and out of the iMac; and cooling the new machine requires two large heat sinks and three large, low-noise fans.

Source:http://arstechnica.com/apple/news/2009/10/magic-mouse-oh-my-godits-full-of-capacitive-sensors.ars

Thursday, October 22, 2009

Technology Fails: 8 Extreme Electronic Disasters

 

Friendly Computers would like to inform you about the eight extreme electronic disasters that seems to effect each and everyone of us.

 

Let's face it: Technology seems made to stop working. Screens crack, circuits short, and power supplies abruptly conk out. It's all part of the complex and confounding ecosystem of electronics.

The worst, though, is when something really is built to break--and in the most extreme way. I'm talking fiery explosions, flying components, and acid-leaking compartments, all courtesy of bugs built right into ill-fated devices.

Sound far-fetched? Hey, we've seen some crazy stuff happen over the years. Some of it is astonishing; some of it is merely annoying. But all of it is extreme--and entirely too real.

We start with some good old-fashioned spontaneous combustion.

Combustible Computers

Laptop fire filmed at Los Angeles International AirportNothing screams "tech disaster" like a laptop on fire. Due to the intricacies of modern-day electronics, it takes only a minor manufacturing error to send your system up in flames--and not the kind generated by the jerks of online forums, either.

The most extreme example of fire-related fallout may be the massive series of recalls brought about by bad Sony batteries in 2006. Small shards of nickel made their way into the batteries' cells during production, causing numerous systems to overheat and sometimes catch fire. The recalls affected laptops sold by Dell, Hitachi, IBM, Lenovo, Toshiba, and even Apple.

By the end, a staggering 9.6 million laptop owners had been burned (figuratively speaking) by the failure, and Sony had spent nearly $430 million to replace all the defective units.

Lest you think I'm just blowing smoke up your ash, let me assure you that this danger was far from hypothetical. (Watch PC Pitstop simulate a laptop battery explosion where the temperatures soared to 1000 degrees.) A Sony-battery-powered laptop famously exploded and caught fire at the Los Angeles International Airport in 2007, and a traveler managed to catch the entire incident on tape.

Be warned: You will hear a few expletives shouted during some of the more dramatic moments. With a blast like that, I'd say they were warranted.

Fire risks have led to countless other laptop battery recalls over the years. Scientists are now working on developing a new material that could better protect the lithium ion technology and keep such short-circuiting from occurring.

Exploding iPhones

Apple's all about glitz and bang for its product launch events. Lately, however, the company has been making headlines for a different kind of spark. Reports surfaced in late July suggesting that numerous iPods and iPhones had erupted in flames and scalded their owners.

Soon after, word broke that the European Union had launched an inquiry into exploding iPods overseas. Apple reportedly claimed that some sort of improper handling led to the explosions, calling them "isolated incidents." A full investigation is currently under way.

The recent rash of complaints isn't the first time Apple's iPods and iPhones have come under fire. In March, an Ohio mother sued Apple over allegations that her 15-year-old son's iPod Touch had malfunctioned. The device, she said, exploded in the teenager's pants.

Speaking of explosions, did you hear about those new porn-star apps people are downloading?

Acid Rock

Guitar Hero controllerThe avatar for Kurt Cobain may be making Guitar Hero headlines right now, but one year ago a far more corrosive controversy was connected to the product. Rage Wireless Guitars, a series of controllers sold for use with the game, were found to have circuit-board defects that could cause battery acid to leak outside the devices.

If you're not sure how severe of a problem that could be, just think about this: Over what area of the body do most people hold a guitar? Yeah...not the best place for a chemical burn. It actually happened to at least one person, too, according to reports filed with the manufacturer and published by the U.S. Consumer Product Safety Commission.

That's one disaster I'd suspect even the great Jimi Hendrix, famously fond of both acid and fiery guitar solos, wouldn't be willing to risk.

Red Ring of Death

Xbox 360 red ring of deathIf there were an award for the most extreme-sounding technology flaw, the red ring of death would win, hands-down. Microsoft's Xbox 360 became known for it due to a widespread hardware failure that reared its ugly head in 2007. Its signature sign: three red lights blinking at you, like a disco flashback gone horribly awry.

The lights were more than a mere nuisance: They were frequently an indication of a complete hardware failure that had rendered the system useless. The issue was severe enough to earn the Xbox 360 the branding of "least reliable gaming console in recent history" from at least one publication.

Microsoft ended up spending a reported $1 billion to extend warranties as a result of the red-tinted menace, citing an "unacceptable number of repairs" as the catalyst for its decision. The company also agreed to reimburse customers who had spent their own cash trying to get their consoles fixed.

Recently, a second red-ring-like error has cropped up on some Xbox 360 systems, causing users to see a fatal error with the code "E74." Though the dreaded red lights themselves don't flash, the console is again rendered useless. Microsoft announced in April that it would offer a similar extended warranty and repair reimbursement program for anyone affected by the issue.

Melting Multimedia

Durabrand DVD playerWe all want home theater systems that make us feel like we're inside the movies--but when your DVD player actually reproduces on-screen fire inside your home, things have probably gone too far.

Wal-Mart recalled 4.2 million Durabrand DVD players this fall after discovering that the devices could overheat and set an entertainment center aflame. The company received more than a dozen reports of overheated players, at least seven of which ended with some kind of property damage to the owner's home.

Other multimedia devices recalled due to reported fires or fire risks include DVD players by Toshiba, digital cameras by Hewlett-Packard, and speaker systems by Philips Magnavox.

Retail Viruses

PC virusesWould you like a virus with that purchase? In an age when keeping up with the latest security threats can feel like a full-time job, knowing that a virus could come preloaded on brand-new technology is a real kick in the pants. Unfortunately, it's also an all too common occurrence.

In some cases an entire computer system could be the culprit. Last fall Asus announced that it had accidentally shipped a line of Eee Box PCs with preloaded viruses. A malicious file on one of the systems' hard drives would not only infect local data but also copy itself to other drives and external storage devices connected to the computer.

Viruses have been found on new digital photo frames, USB flash drives, factory-sealed hard drives--and yes, even some iPods. (Those models, it probably goes without saying, were not the "funnest ever.")

Disappearing Data

You don't need a built-in virus to leave you with a manufacturer-caused data disaster--you can also experience one of the always-popular instances of crappy-hard-drive-itis.

Plenty of people came down with the disease earlier this year when Seagate revealed that its Barracuda 7200.11 hard drives had a firmware bug that was causing widespread failures. According to user reports, the drives would die while booting up, leaving no way to access any of the data inside.

Once Seagate isolated the bug, the company offered free data-recovery services to try to make up for the mess-up. Gauging from various online discussions, though, its customers' goodwill is likely one thing the company can't recover anytime soon.

Dangerous Rides

A SegwayAs if Segway riders didn't already look goofy enough, a couple of apparent glitches started sending them flying through the air a few years back. The two-wheeled transporter, as the late Rodney Dangerfield might say, just can't get no respect.

The trouble started in 2003, when Segway had to recall about 6000 of its devices. In that case, the company found that riders could suddenly fall off when the vehicles' batteries ran low. Then, in 2006, a second recall targeted 23,500 more Segways; that time, the devices were found to be "unexpectedly apply[ing] reverse torque" (translation: "causing people to eat pavement").

Thankfully for Segway users, those problems are in the past. Now mall cops are back to relying on their own instincts--and, of course, the fact that they ride around on silly-looking stick machines--to look like total twits.

(Photo of a burning laptop, used as promotional art for this story: Courtesy of Secumem, Wikimedia Commons)

Source: http://www.pcworld.com/article/173933/technology_fails_8_extreme_electronic_disasters.html

Tuesday, October 20, 2009

HP's New Touch Screen Laptop and All-In-Ones Debut

 

Friendly Computers  discovered the NEW touch screen HP Laptop. We thought you might be interested in today’s technology is now rising up to.

 

HP is taking touch to the people, with new touch screen laptop and desktop models, all featuring Windows 7 and some shipping on Oct. 22, when the new operating system is formally introduced.

The new multi-touch models include a number of applications that take advantage of the interface, including Hulu, Netflix, Pandora, Recipe Box, a webcam "photo booth" application, and the HP Music Store.

  • HP TouchSmart tx2 -- A laptop, starting at $799, with a 12.1-inch screen that rotates 180-degrees for use as a tablet. Besides touch commands, users can write or draw on the screen with an electronic pen. Available Oct. 22.
  • HP TouchSmart 300 and 600 -- Are the third-generation of HP's touch-enabled desktops. The 300 has a 20-inch screen and the 600 (shown) has a 23-inch display. The 300 starts at $899 and will begin deliveries on Nov. 1, with the 600 due Oct. 22 and priced starting at $1,049. Read our review of the HP TouchSmart 600.
  • HP TouchSmart 9100 -- An all-in-one desktop, starting at $1,299, which includes a 23-inch touch screen. It can be used as standard touch screen PC or tasked as a map or events kiosk in an office, hotel, or other location. Deliveries begin in December.
  • HP LD42200tm -- A digital signage device with a 42-inch touch screen. Available in December for $2,799.

Besides touch screens, HP also introduced several business desktop and laptop computers as well as new value-oriented Compaq-branded desktops and a laptop.

The Compaq Presario CQ61z (where do they get these model numbers?) costs only $399 and features a 15.6-inch screen, after $100 instant rebate. The Compaq 500B business desktop sells for $359, while the new Compaq Presario 4010f desktop sells for $309.

My take: The laptop looks very interesting and I will consider purchasing one during my next upgrade cycle. I am not wild about reaching out to touch a desktop, although HP is pushing these models for entertainment and kitchen use, where touch makes some sense.

In the kitchen, the touch screen is meant to be used with recipes and other applications that can work entirely by touch when keyboard use isn't appropriate. Verbal directions are also provided.

The new Compaq's are a welcome addition to lowest-priced laptops and desktops. The laptop competes with netbooks on price and will win some of those battles.

Source: http://www.pcworld.com/businesscenter/article/173551/hps_new_touch_screen_laptop_and_allinones_debut.html

Friday, October 16, 2009

Email Isn’t Dead- But It Is Broken

Friendly Computers found this article to be quite interesting. With all the websites like Twitter, Facebook and many others, this guy seems to think that are email days are over.

 

e-mail_icon

PCMag.com's managing editor for software, Sean Carroll, just got back from that rare place few of us can imagine these days: a two-week vacation. We got by without him, his reviews posted, and he only lost one staffer (his senior editor, Matt Murray, just took the reins at ExtremeTech.com). He returned refreshed and reenergized, only to discover an inbox box of 2,200 messages! E-mail, that revolutionary advance in human productivity, is sucking our time. E-mail is, to be blunt, broken. And it is going to take some new technologies, and some changes in human behavior, to save it.

Just this week, The Wall Street Journal, hardly a hot bed of techno-radicalism, ran a story suggesting that e-mail's days are numbered. With the advent of Twitter, Facebook, and Tumblr, sending a plain old e-mail seems not just dated, but ineffective. If you sent Sean Carroll an e-mail over the last two weeks, you know what I am talking about. It was once poor etiquette not to return an e-mail. Now most of us can honestly say we missed it. Personally, I get 300-400 e-mails a day, (I send about 30)—can you blame me if I missed one, especially if it is from an address I have never seen before?

Now, I should probably admit that I have mixed feelings about e-mail. One of my earliest stories at PCMag was 50 Reasons Not to Send that E-mail. I came up with a lot more than just 50. My biggest problem with e-mail, however, is that people just send too much of the stuff. It's sometimes a result of misdirected manners: I can't resist typing "thanks" and hitting Send. But most of the e-mail I receive is just useless—press releases, random story pitches, line edits on a story, press releases, obscure-newsletters-I-never-signed up-for, press releases, office joke threads. (Okay, I have chimed in on some of those, too.) Honestly, keeping a heavy finger on the Delete key can resolve a lot of these annoyances and keep your inbox free.

Let's not forget that, at its core, e-mail is a form of mail. Mail used to take three to four business days, now it takes three to four seconds. Too many people measure their importance based on how many e-mails they read, and their self-worth on how many e-mails they send. We have hit the tipping point: we can no longer read all the e-mail we create. Technology can help. And it will.—Next: The Wall Street Journal Is Right >

The Wall Street Journal is right (...gulp, did I just type that?). We are creating a new communication vocabulary, an evolving new media vernacular. Instant messaging is used for real-time cube-to-cube messages. If it is just office gossip, and I'm busy, I can ignore it. Texting is a great way to communicate point-to-point, and I can respond instantly or hours later. Best of all, you have to know my number to reach me, and I don't spread it around. Social networks like Twitter and Facebook are great for broadcast communications, and, when I have time, more direct conversations. It is impossible to call all of my old friends every week, but a few minutes here and there on Facebook, and we can keep in touch. I think there is a phone in my office as well, but I am pretty sure it just makes outbound calls.

I am currently testing a host of software tools designed to help you manage your e-mail. Xobni works with Outlook to provide context to all of your e-mail communications. When someone sends me an e-mail, Xobni shows me their most recent e-mails, social network profiles, any attachments they have sent me, and most importantly, their photo, pulled from LinkedIn. Just seeing the face of the individuals I am e-mailing is a wonder. I am also looking a Gwabbit, a small app that sucks up the signature information at the bottom of e-mails and drops it into a Contact file. I am still testing, but so far it's amazing.

Then there is Google Wave, Google's attempt to combine e-mail, IM, search, collaboration software, photo management, and about a dozen other applications. Despite seeing and participating in lots of demos, Google Wave is a technology that you have to use to understand. It is like trying to explain Facebook to someone who has never logged on. We are just starting to use Wave at the office, so I will report back when I understand it better.

Given my job, I am a huge fan of technological solutions, but fixing e-mail is going to require some serious behavioral modification. We need to rethink how we use e-mail. It isn't a real-time communication tool, and shouldn't be used as one. It may seem like we can send and receive an infinite supply of e-mail, but we can't. Sending a lot of e-mail doesn't make you more productive—in fact, it makes everyone else less productive. Choose your e-mails carefully, for you own productivity and sanity. And for mine, too.

Source: http://www.pcmag.com/article2/0,2817,2354216,00.asp

Tuesday, October 13, 2009

Kaspersky Lab announces publication of The Cash Factory

Friendly Computers wants to inform about the malicious bots that download programs from the Internet, including a Trojan designed to steal passwords to FTP clients used to manage website content and these passwords can then be used by cyber criminals to modify websites and place malicious tags on their pages.






Kaspersky Lab, a leading producer of secure content management systems, announces the publication of its latest article, The Cash Factory. The article looks at the methods used by cyber criminals to create and run botnets in order to generate large profits.

The article is authored by Sergei Golovanov, Senior Malware Analyst, Igor Sumenkov, Head of Kaspersky Lab's Content Filtering Infrastructure Development Group, and Maria Garnayeva, Malware Analyst.

The Cash Factory unveils the cyclical process used to create botnets from computers infected by the bot Backdoor.Win32.Bredolab. First, cyber criminals hack a site's content management system and modify its pages with tags that redirect to websites containing malicious exploits. These exploits pave the way for infection and penetration by other bots, which then join to form a botnet and obey commands issued from a remote command and control center.

The bots download malicious programs from the Internet, including a Trojan designed to steal passwords to FTP clients used to manage website content. These passwords can then be used by cyber criminals to modify websites and place malicious tags on their pages.

The process is essentially a vicious circle that can be repeated and extended, and is used by cyber criminals to ensure the smooth running of their "cash factory."

The full version of The Cash Factory is available on viruslist.com. The executive summary is available here.

The material can be reproduced provided the author; company name and original source are cited. Reproduction of this material in re-written form requires the express consent of the Kaspersky Lab PR department.

Wednesday, October 7, 2009

Avoid being a victim of an e-mail phishing scam

Phishing scams are attempts by cybercriminals to steal your information, usually by directing you to a website that looks like your banking or email website and asks for your log-in information. Friendly Computers found some useful tips for keeping your information away from phishers.  Read more below…

A recent phishing scam resulting in usernames and passwords of Microsoft's Hotmail, Google's Gmail, and possibly accounts of AOL and Yahoo users being posted online is cause for concern for anyone who uses any of those services. Rather than panic, though, there are simple ways to avoid becoming a victim or being further victimized, if your account has already been compromised.

Microsoft and Google said the compromised information likely came as a result of a phishing scam, through which millions of people are sent e-mail (often warnings about a fake security breach), asking them to click on a link to take them to a Web site so that they can enter their correct information.

When phishing attacks first became prevalent, the fake sites were often crude imitations of the real things, but these days, they can look exactly like the legitimate site, typically of a bank, a payment service such as eBay's PayPal, or another financial company. When the user logs in with a username and password, or provides credit card numbers and other confidential data, that information is captured by the e-mail senders, who can use it to impersonate the victims.

In addition to someone being able to read your messages, a risk of having your e-mail account compromised is that many sites will send a lost password to an e-mail address, so if criminals can access your e-mail, they might be able to use it to get passwords from other sites, including financial accounts.

BBC News is reporting that it has seen lists containing more than 30,000 names and passwords, some of which "appear to be old, unused or fake," but "many--including Gmail and Hotmail addresses--are genuine." To put this into context, Gmail and Hotmail sites had more than 84 million unique visitors in July. Yahoo Mail had more than 156 million unique visitors, according to ComScore.

Here's some advice that can help you avoid becoming a phishing victim.

Change passwords regularly
Even if this particular breach hadn't occurred, many experts recommend that you change your password about every three months. This is as good a time as any to do just that. It's also a good idea to avoid using the same password on multiple sites, but if you're one of the many people who have done that, be sure to change your password elsewhere. Gmail asks users to provide them with an alternate e-mail address, so be sure to change the password for that account as well.

As I pointed out in this post about password security, consider using a password manager like LastPass (free) or RoboForm that can generate and manage strong passwords.

Click cautiously
If you get an e-mail that appears to be from legitimate site with a request that you click on a link to visit the site for any reason, including updating your security information, think before you click. It might be taking you to a rogue site that captures that information for possible identity theft or other crime. It's safer to just type in the URL yourself. Be extremely wary of any requests to provide Social Security numbers or credit card information, unless you're absolutely sure that you're dealing with a legitimate site. When visiting a site, make sure that the URL is that of the organization.

Look for secure sites
If you're asked to provide sensitive information such as a credit card number, be sure that the URL begins with "https" (the "s" stands for "security") and that there is a padlock icon, typically in the lower-right corner of the browser.

Use a phishing filter and good antimalware software
The most recent versions of most browsers, including Microsoft's Internet Explorer and Mozilla's Firefox, help filter phishing sites, as do security suites from McAfee, Symantec, TrendMicro, and other companies. Security software also helps protect you against malicious software that can log your keystrokes, or otherwise jeopardize your privacy and security. Make sure that your security software and your operating system are up-to-date.

Think critically
If something seems too good to be true, it's almost invariably too good to be true. Think about what you're about to do on any site you visit, especially if it's a site you don't already trust. Never use the same password on an unknown site that you use for e-mail, banking, or other sites where security is essential.

The U.S. Department of Homeland Security's National Cyber Alert System has additional tips to help you avoid phishing and other social engineering attacks, and ConnectSafely.org has tips to create an manage strong passwords.

Source: http://news.cnet.com/8301-19518_3-10368801-238.html

Monday, October 5, 2009

BEBLOH steals your money and hides it from you

Friendly Computers gained information about a frightening new malware that can steal money from your bank account, and will re-write online banking pages to disguise these transactions. Read more below…

Trend Micro analysts have come across a new variant of the BEBLOH family of information stealers that goes well beyond the traditional tactic of logging keystrokes and sending it to another server for exploitation. Instead, this particular variant steals user information, uses it right away, and cleverly disguises it from users.

This particular variant, detected as TSPY_BEBLOH.AE, immediately connects to a command and control (C&C) server when it is executed. It downloads an encrypted configuration file from the said server, as seen below:

Click
Figure 1. Captured traffic between affected system/C&C server

The configuration file contains key information, most importantly the name of the bank being targeted. If the user logs into the secure banking website of the target bank, their user name and PIN are both captured by the malware.

Instead of sending the account information to cybercriminals via e-mail or a website, however, it uses this to steal money from the account. If prompted by the central C&C server (which it contacts periodically), it transfers money from the user’s bank account to an account specified in the configuration file (The amount is also based on several parameters included in the said file; the values of these parameters are chosen to minimize the possibility of detection). Very good technical details can be read here.

Lastly, it also disguises its malicious transactions from the user. When the user attempts to view static pages that contain information such as remaining account balance(s), balance sheets, and previous transactions, the malware rewrites these pages on the fly, disguising any previous thefts from the user. Victims would not know they had been robbed unless they attempted to access the online banking site from an uninfected machine, or used separate facilities such as ATMs.

Source: http://blog.trendmicro.com/cooked-balance-sheets-bebloh-style/