Monday, April 13, 2009

Microsoft Access Security

In the ever-changing world of computer software and programming, it is only inevitable that malware will also change. It would be convenient if malware never changed, never was updates, was always the same. This would make combating it not only easy but could be done with very little effort what-so-ever. But unfortunately the creators of malware are almost as smart as the creators of anti-malware, so it is an ever changing battle. The three types of malware discussed in the book are phishing, spam, and spyware. (In correction, only one of these is actually malWARE, but I use the term as a general description of any program, device, or scheme used in an attempt to uproot the integrity of a program's or person's security. Basically, scum is scum, no matter how you label it.)

Phishing is a sometimes elaborate scam to steal your identity through the creation of a mock website. For example, a familiar website is altered to look like that the victim is familiar with. The domain name is created using characters from a different language. These are called homographs and are usually sent to the receiver's personal email requesting personal information. Many fall for this because the homograph they are viewing looks identical to the real one. Spam is unsolicited email sent out in mass quantities. The sheer number of spammers out there is mind boggling. Imagine if you got a hundred telemarketing calls a day. Spyware is software that has purpose of collection personal information off of your computer. They piggyback on programs that sound legitimate and then hide in your system. Spyware is closely related to Adware, which upon being downloaded onto your computer it displays numerous pop-up ads and advertisements. This is much like inviting someone into your home that once inside turns out to be a traveling salesman.

Microsoft Office 07 has a feature called the Trust Center which helps to protect you from attached code attacks. The Trust Center checks add-ins for trusted publisher and code locations, and gives you the heads-up if something looks phishy (pun intended). It is always good to activate macro, ActiveX, add-n, and VBA code detection and notification when using Microsoft Office programs, especially when using them on a network. The Trust Center also helps to protect you against homographic attacks by detecting potentially phony domain names and addresses. Basically it's like having your own personal FBI agent inside your computer, but you still have to use wisdom and discretion. Never open emails or download programs that you are unsure about. The Trust Center can do its job well, but if you are consistently opening the door for malware to disrupt your systems integrity it is only inevitable that something phishy will slip through security.

My experience with these types of malware is limited, more of it being from an observational stand point rather than through actual mistakes. I did make the mistake once of cluttering my computer up with adware and spyware, but after cleaning up the mess with anti-malware programs I conceded to learn my lesson and have never had a problem with them again. I’ve seen phishing websites, and they do look very legitimate, but was never foolish enough to fall for them. And who hasn't had to deal with spam. It is the most ridiculous form of advertising known to man. I've taken marketing and sales classes in college and one of the most important things they teach you is that niche marketing has a much greater effect than mass marketing. If you're sending out your spam to 10,000+ email address, this is an example of what will happen: a) 20% of the email addresses will be invalid or inactive, b) 90% of what is left will be automatically sent to the recipient’s junk mail folder and deleted without viewing, c) 80% of what actually reaches an inbox will be deleted without being read, d) of what is even read-either out of curiosity or ignorance-80% will be deleted, e) of those who even look into what you are offering by visiting the link or whatever else you provide, 90% will decide that it is stupid or uninteresting because they aren't in the target niche to begin with. So when taking these percentages and using a hypothetical number of 10,000 email addresses, you would have 3-4 people actually interested (albeit naively) in what you are offering. This is a 0.035% success rate. Not exactly a profitable enterprise is you ask me.

1 comment:

Bernard Von Poobely said...

Very good, you covered it.