Protection against WiFi Viruses and Attacks

Security researchers have designed a virus that spreads silently through WiFi networks. The "Chameleon" virus replaces access point firmware and masquerades the settings and administrative credentials, which makes it very difficult to detect this virus.

Fortunately, the virus can be blocked by following good WiFi security practices. Unfortunately, many WiFi networks are not set up in a secure way.

Fortunately, the steps to secure a home WiFi network are not particularly difficult:

• Use AES encryption. WEP encryption and TKIP encryption have known weaknesses that are easily exploited. (Depending on your router, you would choose WPA2 or WPA encryption and select AES as the standard.)
• Use a password that is hard to break. It should have more than 20 characters, and should include a mix of upper and lower case letters, numbers, special characters, and even spaces. Entire sentences may be appropriate, if they are not publicly known.
• Change default administrative password and IP address. A surprising number of home installations still use the defaults.
• Turn off remote administration features. Administration should be required to be done over a wired connection.
• Verify that your firmware is updated. There are a number of bugs that have been reported against WiFi router firmware.
• Log out of your administrative sessions when you are done.

Beyond securing your own routers, you need to keep in mind that public routers may also have been infected. There are some steps you can take to protect yourself when connecting to public WiFi routers. Be aware that public networks are by definition insecure, whether WiFi or wired. There is little or nothing to stop a miscreant from trying to snoop your connection.

• Enable built-in firewall features on your computer, especially software firewalls. Deny all incoming connections.
• Make sure file sharing is turned off.
• Be aware that passwords may be sniffed by keyboard loggers, pulled from your computer's registry, or simply observed over your shoulder. By using a tool like LastPass or Password Safe, you can avoid having to type passwords while storing them in a secure, encrypted location.
• Use a VPN if possible.
• Use https (HTTP over SSL) to connect to vendor sites wherever possible.

Upcoming Events

I look forward to seeing some of you at an upcoming class.

My class, "Technology Manager's Survival Guide" is on the Friday afternoon training schedule at LOPSA-East on May 2 in New Brunswick, NJ.

And I'll be presenting a two-part class, "Leader's Survival Guide," in Jacksonville, FL on July 16 and 23.

Allowing Outside Vendors on Your Network

Recent revelations about the Target attack have re-focused attention on the dangers associated with allowing an outsider on your internal network. There are a few key lessons we can take from this episode:

• Use strong authentication. Passwords just don't cut it in today's environment.
• Segment your network properly. It appears that Target did not fence off its HVAC vendor from its Point of Sale (POS) systems.
• Require background checks. If you require background checks for your own employees before they are on your network, your outsourcing contracts should require the same level of checks from your vendors.
• Monitor traffic on your network. Network segmentation errors will occur, but hopefully someone would pick up on SQL Injection attacks from your HVAC network.

Bring Back Net Neutrality

In January, a federal appeals court struck down the FCC's regulations regarding net neutrality. In arguments in that case, Verizon indicated that it wanted to pursue "different pricing service models."

(In other words, they want to throttle traffic for content providers who don't pay up. In fact, they want it so badly that they stated it five separate times during arguments.)

In the wake of the ruling, it appears that Verizon is doing exactly that. Reportedly, Verizon reps are telling customers that the reason that services (such as Netflix) that run on Amazon's AWS platform run so slowly on Verizon's network is that they are being throttled.

(Verizon is clearly betraying its New Jersey roots. "That's a real nice service you're offering there. It would be a real shame if something happened to it." Who knew that they had hired Tony Soprano to plan their corporate strategy?)

Earlier this week, House and Senate Democrats introduced legislation to re-institute the former net neutrality rules. The legislation is known as the Open Internet Preservation Act.

Good luck to them. Given that most people have a very limited selection of broadband providers, I'm not sure how the FCC ever considered them anything other than common carriers.

Interview Tips

Career Builder posted a press release that outlined several major turn-offs during a job interview. It is well worth a read.

The article includes results from a survey of hiring managers. 87% of hiring managers have formed their opinion in the first 15 minutes, mostly based on non-verbal body language cues. Here are some body language pointers from the survey results:

• Make eye contact. 70%
• Smile. 44%
• Use good posture. 35%
• Don't fidget in your seat. 35%
• Don't fiddle with items. 24%
• Handshake that is strong enough. 27%
• But not too strong. 5%
• Crossing arms over chest (closed body posture). 24%
• Touching hair or face. 24%
• Appropriate use of hand gestures. 10%

Here are some other pointers from the survey participants:

• Be engaged and interested in the conversation. 55%
• Dress appropriately. 53%
• Avoid arrogance. (Stick to facts and figures. People know when you're inflating your role.) 53%
• Don't speak negatively about others. (This is about you; stay positive.) 50%
• Turn off your cell phone during the interview. 49%
• Inform yourself about the company and the opening. 39%
• Back up your statements with evidence. Use facts and specific examples. 33%
• Ask appropriate questions about the opening. 32%
• Limit the amount of personal information revealed; this is about your qualifications, not your personality. 20%
• Do not ask the hiring manager personal questions. 17%

The survey also revealed some howler mistakes by interviewees. You should steer clear of these.

• Answered a phone call about an interview with a competitor.
• Pulled out teeth while asking about dental benefits.
• Crashed car into building.
• Interviewee reported that valium was impairing her presentation.
• Acted out a role from Star Trek
• Set fire to interviewer's newspaper.
• Kept headphones on during interview.