The Tech Blog of Ken

Generate ultra-secure passwords for your wireless router

Steve Gibson, of Security Now! fame, has a very simple and useful "Ultra High Security Password Generator" on his web site for generating random password strings. Great for generating strong passwords for your home wireless router.

A good but low-tech way of remembering this password is to simply write it on a Post-It note and stick it to the bottom of your router, along with the router password. You rarely have to reenter your wireless password anyway, unless you have a lot of people with laptops coming over to your house all the time.

Security Now! continues to be a must-listen podcast for anyone who is remotely interested in Internet security (that should be you, fair reader). Steve does a great job of explaining complex security principles in plain language. I think I'm fairly knowledgeable about network security, but I still learn something new in every episode.

Patch your Windows systems NOW!

There's an extremely critical Windows vulnerability that has surfaced over the last few days. It is a buffer overflow vulnerability in a DLL that handles rendering of images (Windows Meta File library), so simply viewing a malicious jpg could infect your machine. It's a zero-day exploit, and there are many malicious exploits already in the wild.

It's a nasty hole, according to security expert Steve Gibson in the Security NOW! podcast (ep. 20):

"It is able to install malware in people's computers just by visiting a website. In fact, the guys at F-Secure, while they were fetching a file in a DOS box, it infected their machine because they had Google's desktop search system going. And it turns out, when they fetched the file, Google's desktop system indexed it. And the process of indexing the file caused the exploit to run."

Steve has a great web page explaining the vulnerability, including directions on where to download a good patch:
http://www.grc.com/sn/notes-020.htm

You might also want to run Ilfak's WMF Vulnerability Checker (linked from Steve's page) before and after running the patch for that warm fuzzy feeling.

I've been using my Windows machine only for games and bittorrent, but after this, I think I might limit it only to games.

Steve Gibson and the ubiquitous Leo Laporte have a great weekly podcast covering practical computer security issues. Steve is really on top of things, and does a great job making complex security issues fairly easy to understand. While I'm not a security expert, I consider myself pretty knowledgeable on general security issues, and I still learn something new from each episode. Check it out on iTunes or from the Security Now! web site.

Technorati Tags: wmf, security, windows

encrypt email addresses with Javascript

Those pesky spammers. They're out there harvesting our email addresses right off our own web pages. A simple but brilliant way of obfuscating your email address is to encrypt it using a simple substitution cipher and then decrypt it using javascript when the page is displayed. Simple, but hard to break.

A more common method is to encode your email address using HTML entities or hex codes, but it seems like it would be fairly simple for a spambot to use a regular expression search for the html entity for the '@' symbol among a bunch of HTML entities. Those spammers aren't all stupid, you know.

Technorati Tags: email, javascript, security