How To Test Your Computers Security

Virus Test

The Eicar Virus is a harmless virus that contains a string of characters that will be recognised by all Anti-Virus or Anti-Malware vendors. By downloading it your a/v should detect it and attempt to quarantine it. It can be downloaded in various formats (.txt, .zip) and is available here:

Eicar.org

The file will test that your antivirus is functioning properly.

Trojan simulator is similar but installs a process and a registry autostart entry that your av package should detect:

Trojan Simulator

Firewall Testing

Inbound

A firewall should be able to block incoming attacks from trojans or hackers. To test this ability it is good to see which ports are hidden on your computer or “stealthed”.

A good website to test your stealthed ports is GRC Shields Up! Follow the link below then click on shields up and follow the simple instructions.

GRC Shields UP!

For a firewall to be effective it needs to stop malware from contacting the internet. Malware may connect to upload stolen info, download more malicious software or serve you adverts.

Outbound

To test whether your firewall will allow leaks in different ways you can use the software from Comodo on this page:

Firewall leak testing tools from Comodo

This software when run will try and communicate with the internet in various sneaky ways to try and bypass your firewall. A good firewall should stop these methods. Don’t let your A/V block the file, as it may be detected as a potentially unwanted program but isn’t a virus.

Popups, as well as being really annoying can serve you malware. To test your Browsers Popup stopping ability then try these links:

Popup Stopper Test

Online Popup Blocker Tests

Online Phishing Sites Testing

PhishTank has a list of recently submitted phishes (website forgeries designed to scam in some way).  The confidently brave or secure can check out these by surfing to these links…  But be wary of clicking on these sites as they can often serve viruses. If a phish is detected then your security software’s phishing protection should warn you. Firefox and Internet Explorer in built phishing filters should also provide protection or warnings.

Phishtank.com

Conficker Test

To test whether you have the conficker worm, this website will load an image from some of the websites that the conficker worm attempts to block. The site explains itself better than I can but essentially if you are missing the images you could be infected.

Conficker Eye Chart

Browser Security Testing

Browsers have various security issues and to test your browser then surf here:

Browser Security Test

You may only have vulnerabilities if you are not running the latest version of your browser.

Test Your Email Spam Filter

This website will send you a number of emails designed to test your email software’s spam filtering abilities in a variety of ways:

www.nospamtoday.com

Credit: Jonny

Cracking GSM phone crypto via distributed computing

If you are using a GSM phone (AT&T or T-Mobile in the U.S.), you likely have a few more months before it will be easy for practically anyone to spy on your communications.

Security researcher Karsten Nohl is launching an open-source, distributed computing project designed to crack the encryption used on GSM phones and compile it into a code book that can be used to decode conversations and any data that gets sent to and from the phone

He hopes that by doing this it will spur cellular providers into improving the security of their services and fix a weakness that has been around for 15 years and affects about 3 billion mobile users.

“We’re not creating a vulnerability but publicizing a flaw that’s already being exploited very widely,” he said in a phone interview Monday.

“Clearly we are making the attack more practical and much cheaper, and of course there’s a moral question of whether we should do that,” he said. “But more importantly, we are informing (people) about a longstanding vulnerability and hopefully preventing more systems from adopting this.”

This weakness in the encryption used on the phones, A5/1, has been known about for years. There are at least four commercial tools that allow for decrypting GSM communications that range in price from $100,000 to $250,000 depending on how fast you want the software to work, said Nohl, who previously has publicized weaknesses with wireless smart card chips used in transit systems.

It will take 80 high-performance computers about three months to do a brute force attack on A5/1 and create a large look-up table that will serve as the code book, said Nohl, who announced the project at the Hacking at Random conference in the Netherlands 10 days ago.

Using the code book, anyone could get the encryption key for any GSM call, SMS message, or other communication encrypted with A5/1 and listen to the call or read the data in the clear. If 160 people donate their computing resources to the project, it should only take one and a half months to complete, he said.

Participants download the software and three months later they share the files created with others, via BitTorrent, for instance, Nohl said. “We have no connection to them,” he added.

Once the look-up table is created it would be available for anyone to use.

Distributed computing, which has long been used for research and academic purposes, like SETI@home, and which companies have built businesses around, not only solves the technical hurdle to cracking the A5/1 code, but it could solve the legal ones too.

A few years ago a similar GSM cracking project was embarked upon but was halted before it was completed after researchers were intimidated, possibly by a cellular provider, Nohl said. By distributing the effort among participants and not having it centralized, the new effort will be less vulnerable to outside interference, he said.

Nohl wasn’t certain of the legal ramifications of the project but said it’s likely that using such a look-up table is illegal but possession is legal because of the companies that openly advertise their tables for sale.

A T-Mobile spokeswoman said the company had no comment on the matter.

AT&T spokesman Mark Siegel said, “We take extraordinary care to protect the privacy of our customers and use a variety of tools, many technical and some human approaches. I can’t go into the details for security reasons.” He declined to elaborate or comment further.

Taking precautions