Printable View
I saw this:
http://www.technewsworld.com/story/software/55947.html
And thought "every skiddie must have one". Sure the technology is already there but you need to have some knowledge to set it up. This one comes pre-packaged, and lets you boot Linux on any unprotected PC.
Nice find nihil ! I found it pretty funny ! ... Isn't it taken for granted that if some has physical access to a box, its owned.
Okay, Dr.Evil is interested... But, what if USB boot is disabled ?Quote:
According to Turbolinux, the idea behind the device is "to turn all the world's computer[s] into your PC."
I wonder if he has been living in a cave for the past ten years...Quote:
"The Wizpy sounds most promising because it requires no setup," Benjamin Gray, an analyst at Forrester Research, told LinuxInsider. "The two 1 GB and 4 GB Wizpy models allow plenty of storage capacity for documents and images, although it may pose a problem for larger music and video files."
Its one of those lame attempts by the Japs to squeeze the green out of wannabe elite adolescents.
Hopefully you disable booting from CD as well or Im sure the SLAX boot cd for usb devices could be modified to boot the new toy.
http://linux.softpedia.com/get/Syste...CD-18390.shtml
Of course if someone is booting the box from a USB drive, more than likely they have physical access.
I was wondering what a skiddie is myself.:D
I learned something new every day::)
Quote:
In computing, a script kiddie (occasionally script bunny, script kitty, script kiddo, "skidiot", skiddie or Victor Skill Deficiency (VSD) and even lamer) is a derogatory term for inexperienced hackers who use scripts and programs developed by others, without knowing what they are or how they work, for the purpose of compromising computer accounts and files, and for launching attacks on whole computer systems (see DoS). In general, they do not have the ability to write these kinds of programs on their own. Such programs have included WinNuke applications, Back Orifice, NetBus, Sub7, and Metasploit.
http://en.wikipedia.org/wiki/Script_kiddies
Yes, an attacker would need physical access, but that is exactly what you give a user is it not?
It is question of degree of physical access though. It is quite easy to surreptitiously put in a CD, DVD, floppy or USB device. Attaching another computer or opening the case is a bit more obvious...........so there are levels of physical security.
The interesting thing about this device is that it "lies" to the system and says it is a bootable CD/DVD. It does that right out of the box......... no modification required.
on first analysis I guess that I would:
1. lock the BIOS
2. lock the case (physically)
3. set the boot order to only boot from the HDD.
:)
Sigh, i am changing my settings now! And where is that key for my case.
You have a nice point there nihil ! ... But, TurboLinux is making it sound like its "unstoppable" and "uber cool".
I don't think they are talking about physical access here ... lol !Quote:
According to Turbolinux, the idea behind the device is "to turn all the world's computer[s] into your PC."
interesting, wish I'd seen that a couple of weeks ago, as I had a customer recently ask me if our AV software would protect against script kiddies. I had no idea what he was on about!
Hi,
I work for a small company called IndiaEsecure.com
Recently we had a client who came to us regarding fears of his sensitive data (client’s financial records) being stolen form his computers by his own workers.
Here are some measures we took, we removed all his cd rw, floppy drives and USB drives from the workers computer also removed internet access from windows. We installed Linux in it to allow internet access and removed the 'Fstab' from Linux. So now the user cannot access the fat partion in windows, and send the data as document.
What we teach is this, if some one has physical access to a computer it’s only a matter of time before you data is stolen.
Like wise...if the Skidde has a physical access to the computer an even if the USB boot option is disabled and the bios is password protected, all he has to do is open the box, remove he battery ad whola!
Well he could also use a Live CD for that (Backtrack) but then I guess that stealing data would again require a USB drive.
You can also use Damn Small Linux to boot off a pen drive (9 MB only)
It isn't quite as simple as that.............. if the case is locked, BIOS is protected and you can only boot from the HDD, you would be forced to boot Windows and invoke its security policies.
Also, just try going into an open plan work area and try taking a machine apart in front of everyone? ;)
I wasn't particularly thinking of stealing data either. Not a typical skiddie activity as I see it?
Hi,
It seems that I forgot to mention a few points,all the workers of my client work on windows.So to prevent any transfer of files via internet we removed (disabled) the internet access from there.My client is a Charted Accountant and all most all his work is done in accounting s/w like tally.Internet access for his workers is not his immediate concern.
So even if one worker wants to access the internet he has to reboot the computer into linux and then access it. (XOSL)
In this case he will not be able to access the drive where the senstive data is kept.
And as mention above we we remove all the USB,CD RW ,Floppy drives and put a lock to the computer case.
But then there are some smart chaps who have mastered the fine art of lock picking.
TejasV, old chap,
I spent quite a while working for Price Waterhouse, so I possibly understand your client's concerns?Quote:
Originally Posted by TejasV
His main problem seems to be his HR function............ he should not employ those who cannot be trusted?
OK.............. locks, just as it is impossible to fold a sheet of paper in half more than 7 times, it is impossible to pick a lock with 7 levers......... 6 will make it very difficult.
And, once again, picking a lock (a decent one) cannot be done surreptitiously in an open plan office.
Anyway, how valuable is the financial information?
Another thing, I have worked with Indians for far too many years not to know that you have a dual economy............;)
Your client's clients will not have any "black economy" transactions recorded in his books.............. he is the guy who has to go lie to the taxman is he not?
Hell, I have in the UK, France, Belgium, Germany, South Africa, Australia and the USA :D..............well I considered it "creative tax accounting" at the time :halo:
Hi,
To name a client with that function "Ogilvy" they do it,in India at least (not the locking part :D )Quote:
His main problem seems to be his HR function............ he should not employ those who cannot be trusted?
I was just posting a possibility
You are right.That is none of my concern,My client, the CA want all his DATA secure and not to be transferred from his computers....my answer is "yes sir,will do" :D What say?Quote:
Your client's clients will not have any "black economy" transactions recorded in his books.............. he is the guy who has to go lie to the taxman is he not
Hey, my friend............. they pay............we do :D
Please look for seven lever padlocks............they cannot be picked but are a bit more expensive than the regular five lever ones.
Otherwise, locking down his systems seems fine. I am not sure about encryption...................If I had maybe 10 staff looking after various clients (that would be Staff member "A" looks after clients X, Y & Z) I would look at encryption such that I knew it, and only the staff member responsible for the account could access it ;)
Obviously, people could write things down? but making them individually responsible for their own client base might help?...........sorry I don't know how your man runs his shop................
Writing downa few pages .....possibleQuote:
Obviously, people could write things down? but making them individually responsible for their own client base might help?...........sorry I don't know how your man runs his shop................
Writing down a 1000 pages ......Kinda hard don't you think :D ?
Did i mention of printer security?
There is this saying in Hindi.It roughly translates to this
"Even lord Bhrama cannot catch a in house thief."
No we do not use encryption as of now.Quote:
I am not sure about encryption.
Nihil
What do you think of Sun Thin clients in terms of physical security?
Never worked with one
---------------------
www.indiaesecure.com
Hi, I have worked with thin clients, mostly Citrix.
They do provide an extra layer of security as you can lock down a lot of activity on the local machine. I have even seen a deployment where the users were not permitted to write to the local HDD.
My personal view is that they make it much easier to apply security rules, as you just give the users an icon and access to the applications they need.
Please be careful at dismissing "just writing stuff down"............ after all you don't need to write down that much for an identity theft?
Also, a client's accounts are just a profit and loss statement and a balance sheet and a tax return.............. easily written down ;)
I am sure you do something along these lines but I would always start with some sort of risk and threat level evaluation. Also don't forget physical security (eg. document shredding) and manual checks and balances.
Something like if a cheque is more than Rs 10,000 it has to be signed by a manager and a partner..................and so on.