Ok, I watched a recent episode of AMW with John Walsh. In this program John touted this "new software" that catches child porn on computers. They were showing the results with the usual raids on peoples homes. If he said "incredible breakthrough" once he said it ten times. He then said "other states are looking at using this, all the way to the Federal level."

Here is my concern. Ok, I hate the child porn bastards as much as (most) anyone else. Hang em high, cut off their balls all that. But.

My job deals with DLP, Information Security and the like. The shift has gone from network penetration to application penetration. The ratio is now, regarding data breaches, 70% application vs 30% firewall. What does this mean to you? Well, simply put the BG gains access to an application or web site you are on, or have loaded on your computer. It's a war out there, the threats ever shifting, the hackers getting more and more sophisticated as they come up with new tools to penetrate defenses. Frankly, they are winning. I won't go into how many breaches take place on any given day, but suffice it to say it's a lot.

So, why did it send a chill up my spine? Let's say a hacker wants to store the child porn on YOUR computer. He can do it after accessing your computer creating a hidden file system and you have NO idea that it resides there. I'm talking the "average joe" out there. It's not like the old days when your computer bogs down and gets slow. You go on with your life until there is a knock (or not) on your door and you are busted for being a perv.

Oh sure, some will say "it will work itself out in court". Maybe, maybe not. Is that after you hire an attorney for thousands of dollars and everyone in your neighborhood points at the "child molester"?

Another aspect to all this is "analyzing traffic". We use forensic tools after a data breach, and tools to analyze (monitor) traffic on the network. Fine, the business asked us to do that. I object to the State analyzing MY traffic. They sit there and read all your emails, personal information, trips to websites like this and then store whatever they want, all under the guise of "we are looking for scum". It's very akin to someone watching over your shoulder as you type your passwords in, watching what you are looking at while opening your mail that you picked up from your mailbox. These are all warrant less searches btw because they are looking at ALL traffic on the ISP's network. Think of it (for those at work that have web filtering tools installed (websense etc) like how it is at work. IF you have any brains you know the Network Admin can read everything that you put up on the network. The State is using software and becomes your Network Admin. No privacy at all, gone, zip, nada.

So, especially for your guys/gals that surf porn sites, be very careful out there. You have no idea which file name will trigger the filter.  

You may be next.

So, especially for your guys/gals that surf porn sites, be very careful out there. You have no idea which file name will trigger the filter.






Sure, go ahead and scare the shit right out of me!!

FISHIN!

Seriously, note I said "especially". I thought about folks that surf porn and thought, *those poor bastards"

How many actually surf for porn on the internet?  0.1% or so?  No big deal.

How dare you presume I use the internet to masturbate

This has already happened:

Link



Poor bastard, took over a year to get cleared and he's still fired and had his reputation destroyed.

If that. I wouldn't even know where to start looking for porn on the internet.



 

Hell with that, people surfing can easily go to sites that "look" valid but are actually mirror sites that spoof addresses. "whoops, pop up you just downloaded porn".

OR like I said, you have no idea who is using your computer after it's turned into a bot.

http://video.google.com/videoplay?docid=5430343841227974645

actual figure for porn traffic is 10-20%. AGAIN, the big problem is that your computer becomes a bot and you have NO idea your computer (not you) is disseminating porn

As if some peoples "tinfoil hat" weren't tight enough you go ahead and make it worse.

There's porn on the internet?

This is why if your going to fap to online porn "18yrs or older" you jump on an unlocked wi-fi connection and fap to your hearts content. Or just go to the Porn store and buy a bunch of 1.99 dvd's that should last anyone a long time
.     Or have a techie friend who can install some serious firewall's and anti-viruses.   But then again what do i know they can probably find a way around all this and still install bad things on your computer.



 

If we want to get all realistic and stuff I actually think that if all porn suddenly vanished worldwide computer usage would be cut in half.

Yep, they sure can, that's why 70% of breaches are being done through the applications.

Fortinet actually makes a pretty good appliance designed for SMB/home business owners, but most aren't going to pay the price for it.

NOT POSSIBLE!  Porn was taking up 25% of all web traffic in 1995 man...



With the invention of streaming porn sites, streaming porn, rapidshare/megaupload, and even pay sites... how could it be so low?

I am the guy that investigates stuff like this and people who worked for me helped the FBI and Customs make some of the significant child porn arrests in this country. I am talking about the producers and traffickers of the materiel as well as the folks that handle the kids.

In these rings the most disturbing thing is the type of people that do this and how much access they have to kids. Clergy, doctors, police, paramedics, nurses, etc. That to me is disturbing.

To your issue it may be easy to get that stuff on someone PC and it is, all of us that know, know it is. Simple fact and that fact is not overlooked during the investigation. I have no fear at all that innocent people are being prosecuted and convicted for child porn due to what your fear is. Just isn't happening.  Unfortunately some may be hauled in but to my knowledge none have been prosecuted. The gal who I hired to run that team was a very senior level manager at the National Center for Missing and Exploited Children. She is a sharp cookie and we have discussed this stuff.

And here is something else. When I take my car on the road I have the responsibility to ensure that it is safe to drive and that I am safe to drive. And in a similar fashion if I am going to throw my PC on the internet and hook myself up with a ultra fast always on connection I have a responsibility to secure my machine and understand what is on there.

And those are things you can do now without being a computer mastermind. You don't have to be Bill Gates or Mitnick to secure your system. And if you don't then you may have some uncomfortable nights while they figure out how the stuff got there. You obviously know enough about this subject to know that it is relatively easy with software like Encase to discover the origins of that child porn pict and how it came to be on your PC.

So in short my view is that like everything else in the world we have a responsibility with our computers and saying oh I don't know how is not excuse.

It is too easy to find out if your PC is being used for nefarious purposes. I am not saying that means you should be prosecuted but I don't exactly feel sorry either.  I am glad to see the focus with LEO is growing though. There was a time where LEO rarely went after someone who just purchased a few images. They wanted the big hauls the producers, distro types and directors and money folks.

This seems appropriate.  http://www.youtube.com/watch?v=eWEjvCRPrCo&feature=PlayList&p=4E737540D920CEE8&playnext=1&playnext_from=PL&index=2

Such as...?

I got hacked many years ago and had a bunch of porn dumped on my computer. Which got really awkward to explain when a prospective girlfriend found it.

That's the only time, to my knowledge, anyone has stored anything on my PC in such a manner. If it's happened again, they were much more subtle about it.

There is something else going on with this. He must have viewed at least some of the files or opened them or was somehow shown to have been aware. Or broke security policy.

Hahahaha... Wait are you serious?

That is freaking hilarious!

So I guess your better than the rest of us and never viewed a porn site?

Of course I'm serious!  Why just the other day I gave my wife the exact same statistic.

Do you think a user has some responsibility here? Maybe because I come at this from a different angle and to be clear CP is not my forte terrorism finance and organized crime and computer use is my forte but a group that reported to me had this responsibility.

Anyhow, after years of investigating cyber crime I become more and more convinced that the end user and corporations have definite responsibility in keeping their boxes secure. It is just too important. I have seen too many people get in to financial and other difficulties due to ID theft that started because someone was too lazy or cocky to make sure their db is secure.

I like it when hard working people don't have to deal with the end result of some scumbag screwing up their finances. The best most successful way to avoid lot's of different bad stuff is to take responsibility for your PCs security. No excuses.

   Is this scenario possible while surfing arfcom?

   I have hit many links for youtube and other websites on this site.

http://www.truecrypt.org/

No more internets porn for me...

Sarcasm... I hope. Otherwise, seriously misinformed. This kind of stuff is everywhere...we discovered someone running a robust porn business within our business using company machines; went on for years before it was discovered. I think the 10%-20% figure is probably low... the poster who said, and I paraphrase, 'computer use would be cut in half if all porn disappeared', is probably more correct.

Okay so the key is to secure your stuff.

How exactly?

I have a pretty good idea (avoid porn sites, have a good firewall, good malware, trojan and virus software). Any other hints or advice?



eta Some of us are NOT computer savvy and just do the internet for basic info and entertainment.

And if we would just lock our doors, there would be no thieves.



While I totally agree that we should secure our shit, to say that its the fault of those who don't is kinda dumb.
 

Well actually, what you say is true, to a point. MOST data loss takes place because of seemingly innocent "user error". Inadvertent processing of data. An example would be a user deciding to work on a spreadsheet at home and sending it to their home address to work on it later. It seems fine, but it has left the secure portion of the network and now resides on a unsecured network.

But, as I've said, the hackers are getting smarter and smarter. For example when we do a penetration test, a client may say, "See, you couldn't get in". Well we have already looked at the code and realize that there is a problem, it just takes time to find it. Hackers don't work on a clock and get paid. They are very patient and take lots of time to attack their target.

As to the "take responsibility" part....well, that's a whole nother story. With the increasingly complex methods being used by hackers, keeping "one step in front of them" is getting harder and harder every day. A network that was secure a month ago, might be at risk today.

An interesting take on it is FAIR or Factor Analysis of Information Risk . There are Security assessments and Risk assessments (they really are different)

http://www.infosecramblings.com/2009/01/28/exploring-fair-factor-analysis-of-information-risk/

He probably installed something stupid and in violation of policy or was visiting porn sites, anyhow.

Short answer is "yes". It doesn't matter which application (web site in this instance) is used, it can happen. Probability is lower, hackers are now targeting specific items. This is much different from the "old days" when hackers were mostly kids bent on messing with stuff. These are criminals doing it for monetary gain.

Yeah, I was being conservative (pun intended ) Impossible to put an exact number on it though.

I would say either he has a hell of a lawsuit, OR he got the virus surfing kiddy porn sites (or something like that) and they can prove it.

Most AREN'T anywhere near that savvy. To answer your question (ok I just let out a big sigh ) How?

I'm running as many security tools as I can, most of everyone I work with is doing the same. I posted that Fortinet makes an appliance that is pretty good (it speaks to the application issue) and I have one, but most people aren't going to do that.

Risk is always a percentage. At what point do you accept the risk percentage and at what cost? Unless you lock your computer in a closet and never get on the internet you will have risk. My point though is: "Do you allow the State unfettered access to your computer?"

Get a firewall.  Don't use IE for your browser.  Don't use Outlook or Outlook express for your mail client.  Never click on email executable attachments.  Get a virus scanner and keep it up to date.

For the truly paranoid, get a Linux bootable CD and do all your dangerous browsing from there.  Don't let girlfriends / wives / kids / friends use your computer (because sooner or later they will download something that compromises your system).

What IT security jobs in Methford.. NO WAI!

Well, I wouldn't bank on the lawsuit. They were,after all working on "best evidence at the time" and "in order to protect the community". Forensic computer assessment takes a LONG time, you can't just pull up in a van (like in the Americans Most Wanted case) and say "yep, this guy's computer was comprised"

In this case the guy was absolved, but he did NOT get his job nor his reputation back. Amount he spent defending himself is unknown also.

Probably saved an orange box as something.jse, expecting to shit brix.



 

I don't even know where to begin.


While I agree that people need to be aware of the security issues with their computers, to say that they are responsible for misuse  of their computer by others is ludicrous.

As if I didnt already have enough things to worry about.

LOL, I'm at a remote location, working from my home office. Actually, I USED to work at another well known company here. We didn't have any signs on the door, or a big sign in the parking lot. People would walk in and say "What do you guys DO here?" If I tell you I'd have to kill you.

We used to joke that if the client based in NY NY sitting in their 101st floor dressed in suits could see us, wearing shorts and baseball caps they would be like

I got recruited by another company based in Texas who wanted me more.  

So no IT security jobs in Methford then.. I was like wow did i miss and add in the paper.. Well if you can call the mail tribune a paper..

If your this paranoid you know you can just disable your network adapter when your not using your computer. Then its no longer always on.

You are better off getting on CareerBuilder at putting up your resume. No, I didn't get this or my previous job from the Mail Tribune.

I like it because I can live anywhere I want to, go fishing and shooting anytime I want and don't have someone breathing down my neck all day long.

I think top shelf off the shelf software set up correctly and maintained correctly as well as smart choices in browser settings and general PC security settings if a great place to start. Working in this field I definitely may have a skewed vision here but I am firmly convinced that a computer owner/single user/CISO worker bee have definite responsibilities here. No excuses.

As far as specific recommendations generally any of the big protection companies like Symantec and Mcaffee have good products that work if you use them well. but your needs might be very different than mine. I also kind of like Trend it seems fairly easy to use and while it is robust it seems idiot proof. Meaning if I can do it anyone can.

True, but what they do is have X amount of possible connections if you become a "bot". As soon as you hook up, then your connection becomes active. They constantly search connections and when they become active, then they use it.

You would reduce your risk, but not negate it.