Saturday, October 27, 2007

Show #53


[Download Show #53 as MP3]

News
  • Digital "HD" radio, is it the next "BetaMAX" or, or perhaps its the next "DVD."
    • AM and FM stations tool to battle with Satellite broadcasters
    • So far however, here in the US, response has been "lukewarm" at best according to Wired Magazine's article from January 18th of this past year
    • But it is booming, loud and clear, overseas. The UK's "digital radio" has been popular for sometime now.
    • In fact, since 1999, more than 4.7 million digital radios have been sold in the UK. Listeners browse station listings in an electronic program guide, pause and rewind content as it's broadcast, bookmark specific programs or songs, and record them using postage-stamp-size memory cards. All things that we've seen with Satellite Radio, but its free and its already occurring. Last May, they turned on the feature that allows you to buy songs as you hear them on the radio, downloading them to computers, digital receivers or cell phones.
  • Google Revamps Mail, Reader, and Calendar for iPhone
    • Both Gmail and Google Reader have dropped some weight for the iPhone versions and load pretty fast for even EDGE speeds
    • Some are arguing that because special versions are being made for the iPhone that the Safari browser is different for the iPhone and not a full version
    • You have to remember that you are still looking at these web apps on a 3.5 in screen. And that is not a lot of real estate, designing sites so they are easily viewable on the iPhone is a great way to ensure your product gets used.
  • [Derek] Ubuntu Releases Gutsy Gibbions, the Latest in the Ubuntu Linux Desktop
    • New user interface eye candy with Compiz Fusion, this gives you transparent windows, a desktop cube, and other nifty looking desktop eye candy
    • Contains the latest security fixes for all included software
    • Also contains the latest versions of the included software, including a new version of the Gnome Desktop
    • Printer installation has also been improved.
  • Apple Releases OSX 10.5 (code name: Leopard)
    • The latest version of Apple's OSX operating system was released this past Friday (10/26)
    • Some new features include
      • Spaces
        • This is the equivalent of "Virtual Desktops" in Linux where you can have a desktop for each kind of work you are doing. Have email on one desktop, your word processor on another, and even Photoshop on another.
      • Boot Camp
        • Boot Camp allows you to dual boot your mac into a Windows installation so that you can run a windows application if you need it
      • Time Machine
        • Point in time backups to either the hard drive or an external device.
    • For a guided tour click here
  • Meebo Firefox Extension


Software / Hardware / Power Web Picks
  • Network Printing
    • So, you have a printer in your home office but you are sitting out on the patio with your laptop and you have something you just need to print, what do you do?
    • Well, you could copy the document across your network to the computer that is connected to the printer, or you could upload the file somewhere on the internet and download at the computer with the printer
    • But wouldn't it be nice to just hit the "Print" button and have it print on the right printer?
    • Well there are a couple of ways that you can do this. One requires something as simple as click a few buttons and another method requires to re-setup the printer on at least one of the computers.
    • Sharing a Printer (Method 1)
      • Sharing a printer is the easiest way to grant access to a printer to anyone on your network.
      • To share a printer in Windows XP you simply goto Control Panel, select Printers, right click on the printer you want to share and select "Sharing" this brings up a dialog for you to fill in some information, like the name of the printer and a description. Once you have shared the printer you need to add the shared printer to the other computer by adding a printer and searching for one on the network.
    • Make a USB Printer a Networked Printer (Method 2)
      • Another option is to buy a print server from a company like Netgear or Linksys that will a allow you to connect a USB printer into a network plug making the printer a networked printer that can be accessed by IP address.
      • Once the printer is on the network, you can access it via it's IP address and add the printer that way via the "Add Printer" wizard.
  • Gmail Storage Increases
    • Derek and I's favorite web application, Gmail has increased it's storage capacity to 4.1GB as of this past week and has announced that it will be at 6GB by January.
    • This is great news because more and more people are moving their email to online resources like Gmail, Yahoo Mail, and Microsoft's Hotmail.
    • The pay of storage plans are still available
      • $20/yr = 10GB
      • $75/yr = 40GB
      • $250/yr = 150GB
      • $500/yr = 400GB
Security & Privacy
  • Talk about ways to hide/secure the printer you just shared on the network (if you have a wireless connection, you do not want just anyone printing)
    • TCP/IP Printers - Via Printer Interface / Windows Sharing Interface
    • USB / LPT Printers - Windows Printer Sharing

Sunday, October 21, 2007

Show #52



[Download Show #52 as MP3]

HAPPY 1st BIRTHDAY
TO US!


News
  • Nintendo Market Value Tops 10 Trillion Yen (85 billion)
    • Nintendo has jumped from 5th place in total value to the third in Japan
    • The new value is triple what the company was worth before the release of the Wii and DS
    • It is also a 5 fold increase from 2 years ago.
  • HDTV Makers Want Consumers to do Their Homework
    • There has been a shift in purchasing HDTV systems at normal audio/video retailers to club, warehouses, and mass merchants.
    • The prognosis for rear projection TVs is not good, based on the success of LCD and Plasma
  • Apple to Drop the Price of the DRM free tracks on iTunes to $0.99
    • iTunes DRM Free tracks were previously $1.29
    • This price drop brings Apple more in line with the competition (Amazon.com's MP3 Store) which has tracks for around the same price
    • However, DRM Free tracks from iTunes is still severely limited to only tracks from the EMI music group (only 1 of the "Big 5")
    • While there will be some new DRM-Free tracks from some of the selection of independent artists available on iTunes, the selection is still limited.
    • However, with Amazon getting tracks from some of the other labels, we might see a surge in the total number of available DRM-Free tracks on iTunes

Software / Hardware / Power Web Picks
  • Sansa Review/Prices (Show #1)
    • 1 year ago 8GB Sansa cost $205 (cheapest via Nextag), now you can get them for as low as $149
  • Also 1 Year ago, Zune's were just announced, now with the new versions of Microsoft's media player on the way, lets listen to what we had to say on the first generation 1 year ago.

Penny Pinchers
  • http://www.giveawayoftheday.com/
  • http://www.farecast.com/

Gamer's Corner
  • Playstation Eye - Comes with Eye of Judgement,($65.99 @ Amazon.com Oct, 23rd) reads cards, allows video blogging, and keep your "EYE" out for more cool stuff coming
  • EyeCreate - With EyeCreate you can capture darn near anything and make your own personalized videos, much like the examples I’ve included below. You can also add all sorts of cool effects, record your own sounds and export your video to the XMB. Some of the coolest features include the time-lapse capturing and the stop-motion functionality. If you want to show off your videos, you can drop your creation on a memory stick or USB drive and share it with other PS3 users. The increased resolution of the PSEye and the multi-array microphone combined with the huge storage capacity of the PS3, make the possibilities endless. And last but not least, EyeCreate will be available for FREE download on the PlayStation Store on October 23rd. To get an idea of what EyeCreate can do, check out videos made by the Sony Team.

Sunday, October 14, 2007

Show #51



[Download Show #51 as MP3]

News
  • The Halo Movie is Dead
    • During an interview, director Neill Blomkamp stated that the "entire project is dead."
    • This is mainly due to the fact there were two studios (Universal & Fox) trying to make the movie together and they were not getting along
    • It could also have something to do with the fact that the director attached (Neill) had no prior movie making experience and only a huge endorsement from Peter Jackson (creator of the Lord of the Rings movies) and that because of that neither studio really wanted him to make the movie.
  • RIAA Wins First Jury File Sharing Case
    • In a shocking ruling the jury, in a case where the question of file sharing equating to piracy is actually put on trial, awarded the RIAA $222,000 dollars in damages
    • The RIAA was specific in their instructions to the jury. In these instructions they used the phrase "to make available" thus negating their need to have to actually prove that the defendant actually upload files to people. There is some debate over this issue and I am sure that we will see it come up in appeal. Keep in mind that previous decisions on this issue have been split fairly down the middle in past rulings.
    • This is the first win, but will this help the RIAA in future trials?
    • Defendant plans to appeal the decision
  • Microsoft Announces New Zunes
    • New Zunes come in 80GB (Hard Drive), as well as 4GB & 8GB (Flash)
    • New Zune pad for navigating. Videos show it being touch/slide sensitive
    • DVD quality video via TV out
    • H264 Video codecs
    • Podcasting support
    • Older 30GB Zunes will receive a firmware update that will give them the same exact features as the new models (at least software wise)

Software / Hardware / Power Web Picks
  • Social Networks
    • What is a social network?
      • Wikipedia defines a social network as social structure made of nodes (which are generally individuals or organizations) that are tied by one or more specific types of interdependency, such as values, visions, idea, financial exchange, friends, kinship, dislike, conflict, trade, web links, sexual relations, disease transmission (epidemiology), or airline routes.
      • An online social network is that principal, just put into an online form.
      • There are hundreds of social networks all with specific purposes. Everything from a Star Trek to Bruce Springsteen has some form of an online social network. Not all social networks happen on the web either. They can happen in chat rooms, game systems (Xbox Live), or even newsgroups. Where ever people gather with a common interest, that can be described as a social network.
    • What are some popular online social networks?
      • MySpace
        • What is it? - A website started by a guy named Tom that has turned into the largest social website, and actually the largest number of hits on the entire Internet. Myspace is used as a promotional tool for everything from music to comedy to movies to television. If a company wants to promote something they can use MySpace and guarantee that then will have large exposure.
        • Who is using it?
          • Bands, Comedians, Movie/TV Studios, and normal folks
          • Many independent bands are using MySpace to find a national/worldwide audience (like some of the bands you have heard on our program)
        • What is Cool About It
          • The fact that as a starting out band, musician, comedian, or even film maker you have a place to post your work and create a website for practically free. You can easily create a website that allows you to interact with your fans without having to build your own site or paying someone to do it for you.
        • What is it NOT good for
          • Networking at a business level
            • This is largely because the pages can be customized on a large scale.
            • People are not forced to use their real names
            • MySpace has become a haven for profile spamming
      • Facebook
        • What is it?
          • Facebook is a social networking site that originally only catered to college students. It eventually was opened up to high school students and finally everyone.
          • Facebook has really taken off lately because it forces a slightly more professional profile and the mini-applications that you can customize your profile with. These mini applications help you create a one stop "home page" as it were.
        • Who is using it?
          • Everyone from professionals to high school students. It does not have quite the same reach as Myspace, but it does have a nice market share of the social networking internet.
          • People who want something different then MySpace
        • What's Cool About it?
          • Some will say that what is cool about Facebook is that "it is not MySpace"
          • The mini-applications that you can customize your profile with, or write yourself if you want to do that
        • What is Not Good About it
      • LinkedIn
        • What is it?
          • A social networking site geared strictly towards professionals. Chances are someone you work with is on this site
          • This allows you to grow a professional network of contacts that you can use to help you find a job, get a recommendation/reference, or just to catch up with old co-workers
        • Who is using it?
          • Business professionals who want to keep track of who they know and where those people are.
          • People looking to get a new job and they want to know who is where.
          • Professionals looking to fill position in their current company from the outside.
        • What's Cool About it
          • The fact that you can see how you connect to someone is pretty cool
        • What is Not Good About it
          • The idea of "begging" for a job or help in getting a foot in the door can be something that eerks people
    • What about offline social networks
      • Meetup.com
        • Not quite entirely offline, but the meet ups take place offline
        • There is a "meetup" for just about every interest
        • You can search the meetups by local area
        • You can create your own meetup
Security & Privacy
  • Protecting your privacy on a social network
    • On a social network, there is the temptation to give out a lot of information. The more information you give out, the more likely someone you know will be able to find you on the site.
    • You have to maintain a certain level of caution when deciding what information you wish to show the public as a whole.
      • Facebook gives you several levels of security you can choose when deciding how much you want to show to different kinds of people
      • MySpace allows you to make your profile public
      • LinkedIn allows to decide to show things only to your contacts or network as a whole
    • Also, remember that employers Google potential new hires and your Myspace, Facebook, and LinkedIn pages can show up high on the results list. If you have anything potentially unprofessional on some of these pages, it could harm your chances at getting a job.
      • For instance, Michael's LinkedIn page comes in as the 4th main result
    • It is also good to keep in mind that Google remembers a lot of stuff. The cache that google maintains can hold older versions of your page, or a page that you no longer have that could contain hazardous information.
    • Use common sense when deciding what information to post about yourself on the internet. You never know who might find it one day.

Sunday, October 7, 2007

Show #50



[Download Show #50 as MP3]

News
  • 45% of US Mobile Subscribers Want Better Mobile Internet
    • People will consider mobile internet capability when purchasing their next handset
    • Currently only 26% of users subscribe to mobile internet packages
    • Some attribute this sharp change to the iPhone and other devices like it
    • The mobile internet is becoming a fast track item in most cell companies offerings because more people want their data on the go
  • Joost Opens to the Public
    • Joost is an IPTV that utilizes Peer to Peer technology to deliver video on demand over the internet
    • Currently sitting at 1 million users all acquired through an invite only system
    • Joost is currently ad supported and includes television shows from MTV, Nickelodeon, CBS, and some other specialty channels like National Geographic and Warner Bros. Music
    • Joost opening to to public could have a temporary impact on the service with so many people transferring data across the wire, but Derek and I have been using the service for months now and we have yet to notice any degradation.
Software / Hardware / Power Web Picks
  • Data Encryption
    • The Basics
      • The History of Encryption
        • Encryption started as a manul system where letters would be exchanged by offsetting by a certain number, the key was simple, if my key was 3 you knew that C stood for A, and D for B, by World War II, mechanical and electromechanical cipher machines were in wide use, although. At this time however, great advances were made in cipher-breaking, information about this period has begun to be declassified as the official British 50-year secrecy period has come to an end, and U.S. archives have slowly opened, assorted memoirs and articles have begun to appear.

        • As many of us learned in school, the Germans made heavy use, in several variants, of an electromechanical rotor machine known as Enigma. The US breaking the Enigma code and rebuilding a decyphering machine was the greatest breakthrough in cryptanalysis in a thousand years. At the end of the War, on April 19th, 1945 Britain's top military officers were told that they could never reveal that the German Enigma code had been broken because it would give the defeated enemy the chance to say they "were not well and fairly beaten".

        • US Navy cryptographers (with cooperation from British and Dutch cryptographers after 1940) broke into several Japanese Navy crypto systems. The break into one of them, JN-25, famously led to the US victory in the Battle of Midway. A US Army group, the SIS, managed to break the highest security Japanese diplomatic cipher system even before WWII began.

      • What is encryption?
        • In cryptography, encryption is the process of transforming information, often called plaintext, to make it unreadable to anyone except those possessing special knowledge usually in the form of a key. The result of the process is encrypted information (in cryptography, referred to as ciphertext). In many contexts, the word encryption also implicitly refers to the reverse process, decryption (e.g. “software for encryption” can typically also perform decryption), to make the encrypted information readable again (i.e. to make it unencrypted). [Wikipedia]
      • What is a key?
        • The key to a door has notches that push pins up to open the door
        • Your password is a key (a simple one), when the right one is typed, you can login to your computer or a specific website
        • In encryption a key is a piece of information that specifies the particular transformation of plaintext into ciphertext, or vice versa during decryption. Keys are also used in other cryptographic algorithms, such as digital signature schemes and message authentication codes.
      • Public key cryptography / Asymmateic Key Encryption - A form of cryptography in which a user has a pair of cryptographic keys - a public key and a private key. The private key is kept secret, while the public key may be widely distributed. The keys are related mathematically, but the private key cannot be practically derived from the public key. A message encrypted with the public key can be decrypted only with the corresponding private key.
        • Pros
          • You can literally post your public key anywhere (many people do, there is a large online database of them, even I am in there)
          • You can use the key to verify without a doubt that an e-mail or document was sent from someone based on their electronic signiture
          • You can send a single file destined for multiple recipients using YOUR private key and their respective public key, that means you can make a single download work for multiple people, all they need is their OWN proviate key and YOUR public key to decrypt the e-mail, attachment, picture, or whatever type file you send. You can literally post the file for anyone to download, but only the five people (or one) that you marked can open it with their passphrase and key.
        • Cons
          • A much larger key is required to achieve the same security as a much simpler and smaller symmetric encryption scheme
          • This is a slower form of encryption (not an issue for today's computers on reasonable-size files, but for giant databases it can be an issue)
        • Software
      • Symmetric Key Encryption - A class of algorithms for cryptography that use trivially related, often identical, cryptographic keys for both decryption and encryption. The encryption key may be identical or there is a simple transform to make them identical. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link.
        • Pros
          • Faster encryption / decryption
          • Smaller keys / still secure
        • Cons
          • Shared secret needed at both ends
        • Software
      • Hybrid Systems - This works by using symmetric encryption to actually do the work of encrypting the data, and asymmetric encryption to distribute the keys.
      • What kinds of data should you encrypt?
      • Why should you encrypt your data?
    • Built In Data Encryption
      • Encrypted File System
        • Windows Encryption of File System
          • Advantages
          • Disadvantages
          • Who should use this?
      • BitLocker
        • Available in Windows Vista Business & Ultimate Editions
        • Drive Encryption, not EFS
      • Secure Sockets Layer (SSL)
        • Layer
          • Physical Layer
            • Coaxial Cable
          • Data Link Layer
            • Ethernet
          • Network Layer
            • IP
          • Transport Layer
            • TCP
          • Application Layer
            • HTTP
            • TLS/SSL
        • TLS = Transport Layer Security
        • Designed to prevent eavesdropping, tampering, and message forgery.
        • Eavesdropping = Encryption
        • Tampering = Signature
        • Message Forgery = Trusted CA / Public Key
        • Web browsing encryption
        • Why this is important
          • Banks
          • PayPal
          • Stocks
          • Camera in your house
          • Router access
          • Instant Messaging
        • How to tell if you are using SSL encryption
          • There should be a locked padlock somewhere on the BROWSER, any you see on the page itself don't count.
            • Mozilla Firefox - There is TWO, one in the address bar on the far right side, the other at the bottom right in the status bar, clicking on either gives you information about the web site's identity.
            • Internet Explorer -
          • The bar at the top of your browser should be a friendly color other than white (green, yellow, etc)
          • What if its red? Well, your data is still encrypted, but the certificate is not 100% verified.

Security & Privacy
  • Social Engineering
    • Attribution - Refers to the way people explain their own behavior and that of others. A goal of the social engineer is to have the target attribute certain characteristics to him or her, such as expertise, trustworthiness, credibility, or likability. A social engineer might walk up to a lobby receptionist, put a $5 bill down on the counter, and say something like, “I found this on the floor. Did anyone say they lost some money?” The receptionist would attribute to the social engineer the qualities of honesty and trustworthiness. If we see a man hold a door open for an elderly lady, we think he’s being polite; if the woman is young and attractive, we likely attribute a quite different motive.
    • Liking - Social engineers frequently take advantage of the fact that all of us are more likely to say “yes” to requests from people we like. People like people who are like them, having similar career interests,
      educational background, and personal hobbies. Social engineers will frequently research their target’s background and equip themselves to fake an interest in things the target cares about — sailing, tennis, antiques, airplanes, collecting old guns, or whatever. Social engineers also increase liking through the use of compliments and flattery, and physically attractive social engineers can capitalize on their attractiveness.
    • Fear - A social engineer will sometimes make his or her target believe that some terrible thing is about to happen, but that the impending disaster can be averted if the target does as the attacker suggests. In this way, the attacker uses fear as a weapon. A social engineer masquerading as a company executive may target a secretary or junior staffer with an “urgent” demand, and with the implication that the underling will get into trouble, or might even get fired, for not complying.
    • Reactance - Psychological reactance is the negative reaction we experience when we perceive that our choices or freedoms are being taken away. When in the throes of reactance, we lose our sense of perspective as our desire for the thing we have lost eclipses all else. In a typical attack based on reactance, the attacker tells his target that access to computer files won’t be available for a time, and names a time period that would be completely unacceptable. “You’re not going to be able to access your files for the next two weeks, but we’ll do everything possible to make sure it won’t be any longer than that.” When the victim becomes emotional, the attacker offers to help restore the files quicker; all that’s needed is the target’s username and password. The target, relieved at a way to avoid the threatened loss, will usually comply gladly.
    • The other side of the coin involves using the scarcity principle to coerce the target into pursuing a promised gain. In one version, victims are drawn to a Web site where their sign-on information or their credit card information can be stolen (phinshing). How would you react to an email that promised a brand-new Apple iPod for $200 to the first 1,000 visitors to a particular Web site? Would you go to the site and register to buy one? And when you register with your email address and choose a password, will you use choose the same password that you use elsewhere? How many have you done that?

COUNTERMEASURES
Mitigating social engineering attacks requires a series of coordinated efforts:
  • Developing clear, concise security protocols that are enforced consistently throughout your company or your home
  • Developing security awareness training or reading up on security yourself
  • Developing simple rules defining what information is sensitive
  • Developing a simple rule that says that whenever a requestor is asking for a restricted action (that is, an action that involves interaction with computer-related equipment where the consequences are not known), the requestor’s identity must be verified according to company policy
  • Developing a data classification policy
  • Training employees on ways to resist social engineering attacks
  • Testing your employee’s susceptibility to social engineering attacks by conducting a security assessment

The most important aspect of the program calls for establishing appropriate security protocols and then motivating employees to adhere to the protocols.

Closing

  • Be Sure to visit our website at http://powerofinformation.net
  • Call us on The PowerLine at 866-55-44-POI -- That's 866-554-4-POI.
  • To See What Michael and I are blogging about: click on the links to our blogs at the Power of Information website
  • Special thanks to:
    • Wiley Publishing for allowing us to use parts of The Art of Intrusion by Kevin D. Mitnick and William L. Simon as well as for dending us the electronic copy of the book.
    • Wikipedia for allowing us, and everyone, to use their great encyclopedia under the GFDL - GNU Free Document License originally created by the Free Software Foundation.
  • Special thanks to the band Anberlin for supplying music for our program.