Malwarebytes Anti-Malware 1.70

By Neil J. Rubenking When a Trojan or other malware gets a foothold in your PC's innards, clearing it out can be tough. The nastiest ones fight back, interfering with your attempts to install antivirus software. When that happens, who ya gonna call? In many cases the answer is Malwarebytes. Even tech support agents for other companies may turn to the free Malwarebytes Anti-Malware 1.70 when their own product won't install. And the latest edition is better than ever. You may notice one thing's missing—that pesky apostrophe. Yes, the program name used to be Malwarebytes', a fact that's confused many a copy editor. They also dropped "Free" from the name, and spiffed up the program icon a bit. Really, though, it doesn't look a lot different. Malwarebytes is all business, and its business is scraping out persistent malware. There's no home screen or status page. Launch it and it goes straight to the scanner page. As for settings, there aren't many, and they come pre-configured for maximum protection. Speedy, Hassle-Free Install Sadly, I'm accustomed to needing a full day or more to get antivirus products installed on my twelve malware-infested test systems. When the malware fights back, I have to either engage in email back-and-forth with tech support or sit around while tech support deals with the problem via remote assistance. I do appreciate that support, but I'd appreciate not needing it even more. I had absolutely no trouble installing Malwarebytes on those same systems. The installation is super-quick, and doesn't require a reboot. The update process failed on one system, probably due to a glitch in the connection. A second try succeeded. I installed Malwarebytes on all twelve systems in less than an hour. Fantastic! No Lab Results In general I like to check my test results against results from the independent testing labs. However, getting tested can actually cost money, so many of the free antivirus tools limit their participation in testing. There are exceptions. For example, AVG always submits AVG Anti-Virus FREE 2013 for testing, demonstrating that its free product is just as powerful as its commercial versions.

PasswordBox

Pros Video tutorials and setup task list help new users. Very smooth capture and replay of login credentials. Automatically offers randomly generated passwords. Imports from several popular competitors. Password Legacy transfers credentials after your death. Can share passwords with other users. Supports Windows, Mac OS, iOS, Android. Cons Login records for some sites had to be created manually. Can't import browser passwords. No two-factor authentication. No Web form filling. No strength rating for saved passwords. No ability to group or categorize saved credentials. Bottom Line PasswordBox does a great job of smoothly capturing and replaying your passwords on Windows, Mac OS, iOS, and Android. You can mange up to 25 passwords for free, and its unique Legacy feature ensures transmission of your passwords to someone you trust in the event of your untimely demise. y8

Bitdefender Total Security (2014)

Pros Good results in PCMag antivirus tests; great results in independent tests. Accurate spam and phishing protection. Tough, no-hassle firewall. Full-scale parental control. Facebook monitoring. Private data protection. Password management. Secure browser. Vulnerability scan. File backup and sync. File encryption. Secure deletion. System tune-up. Anti-theft. Cons Some difficulty installing on malware-infested systems. Default firewall configuration omits some protections. Password management limited. Some impact on performance. No drag/drop to encrypt or shred files. Bottom Line With Bitdefender Total Security (2014) you get all the standard security suite features plus file backup and sync, file and folder encryption, system tune-up, and even anti-theft protection. All of the components work well; it's a winner. y8

10 essential security tips: protect your site from hackers

10 essential security tips: protect your site from hackers inShare Short url Ruald Gerber and Toby Compton set out best practices for avoiding security disasters You may not think your site has anything worth being hacked for, but websites are compromised all the time. The majority of security breaches are not to steal your data or deface your website, but instead attempts to use your server as an email relay for spam, or to setup a temporary web server, normally to serve files of an illegal nature. Hacking is regularly performed by automated scripts written to scour the Internet in an attempt to exploit known security issues in software. Here are our top 10 tips to help keep you and your site safe online: Advertisement 1. Keep software up to date It may seem obvious, but ensuring you keep all software up to date is vital in keeping your site secure. This applies to both the server operating system and any software you may be running on your website such as a CMS or forum. When security holes are found in software, hackers are quick to attempt to abuse them. If you are using a managed hosting solution then you don't need to worry so much about applying security updates for the operating system as the hosting company should take care of this. If you are using third-party software on your website such as a CMS or forum, you should ensure you are quick to apply any security patches. Most vendors have a mailing list or RSS feed detailing any security issues. WordPress, Umbraco and many other CMSes notify you of available system updates when you log in. 2. SQL injection SQL injection attacks are when an attacker uses a web form field or URL parameter to gain access to or manipulate your database. When you use standard Transact SQL it is easy to unknowingly insert rogue code into your query that could be used to change tables, get information and delete data. You can easily prevent this by always using parameterised queries, most web languages have this feature and it is easy to implement. Consider this query: "SELECT * FROM table WHERE column = '" + parameter + "';" If an attacker changed the URL parameter to pass in ' or '1'='1 this will cause the query to look like this: "SELECT * FROM table WHERE column = '' OR '1'='1';" Since ‘1’ is equal to ‘1’ this will allow the attacker to add an additional query to the end of the SQL statement which will also be executed. 3. XSS Cross site scripting is when an attacker tries to pass in JavaScript or other scripting code into a web form to attempt to run malicious code for visitors of your site. When creating a form always ensure you check the data being submitted and encode or strip out any HTML. 4. Error messages Be careful with how much information you give away in your error messages. For example if you have a login form on your website you should think about the language you use to communicate failure when attempting logins. You should use generic messages like “Incorrect username or password” as not to specify when a user got half of the query right. If an attacker tries a brute force attack to get a username and password and the error message gives away when one of the fields are correct then the attacker knows he has one of the fields and can concentrate on the other field. Keep your error messages vague 5. Server side validation/form validation Validation should always be done both on the browser and server side. The browser can catch simple failures like mandatory fields that are empty and when you enter text into a numbers only field. These can however be bypassed, and you should make sure you check for these validation and deeper validation server side as failing to do so could lead to malicious code or scripting code being inserted into the database or could cause undesirable results in your website. 6. Passwords Everyone knows they should use complex passwords, but that doesn’t mean they always do. It is crucial to use strong passwords to your server and website admin area, but equally also important to insist on good password practices for your users to protect the security of their accounts. As much as users may not like it, enforcing password requirements such as a minimum of around eight characters, including an uppercase letter and number will help to protect their information in the long run. Passwords should always be stored as encrypted values, preferably using a one way hashing algorithm such as SHA. Using this method means when you are authenticating users you are only ever comparing encrypted values. For extra security it is a good idea to salt the passwords, using a new salt per password. In the event of someone hacking in and stealing your passwords, using hashed passwords could help damage limitation, as decrypting them is not possible. The best someone can do is a dictionary attack or brute force attack, essentially guessing every combination until it finds a match. When using salted passwords the process of cracking a large number of passwords is even slower as every guess has to be hashed separately for every salt + password which is computationally very expensive. Thankfully, many CMSes provide user management out of the box with a lot of these security features built in, although some configuration or extra modules might be required to use salted passwords (pre Drupal 7) or to set the minimum password strength. If you are using .NET then it's worth using membership providers as they are very configurable, provide inbuilt security and include readymade controls for login and password reset. 7. File uploads Allowing users to upload files to your website can be a big security risk, even if it’s simply to change their avatar. The risk is that any file uploaded however innocent it may look, could contain a script that when executed on your server completely opens up your website. If you have a file upload form then you need to treat all files with great suspicion. If you are allowing users to upload images, you cannot rely on the file extension or the mime type to verify that the file is an image as these can easily be faked. Even opening the file and reading the header, or using functions to check the image size are not full proof. Most images formats allow storing a comment section which could contain PHP code that could be executed by the server. So what can you do to prevent this? Ultimately you want to stop users from being able to execute any file they upload. By default web servers won't attempt to execute files with image extensions, but it isn't recommended to rely solely on checking the file extension as a file with the name image.jpg.php has been known to get through. Some options are to rename the file on upload to ensure the correct file extension, or to change the file permissions, for example, chmod 0666 so it can't be executed. If using *nix you could create a .htaccess file (see below) that will only allow access to set files preventing the double extension attack mentioned earlier. deny from all order deny,allow allow from all Ultimately, the recommended solution is to prevent direct access to uploaded files all together. This way, any files uploaded to your website are stored in a folder outside of the webroot or in the database as a blob. If your files are not directly accessible you will need to create a script to fetch the files from the private folder (or an HTTP handler in .NET) and deliver them to the browser. Image tags support an src attribute that is not a direct URL to an image, so your src attribute can point to your file delivery script providing you set the correct content type in the HTTP header. For example: 8. Server security Most hosting providers deal with the server configuration for you, but if you are hosting your website on your own server then there are few things you will want to check. Ensure you have a firewall setup, and are blocking all non essential ports. If possible setting up a DMZ (Demilitarised Zone) only allowing access to port 80 and 443 from the outside world. Although this might not be possible if you don't have access to your server from an internal network as you would need to open up ports to allow uploading files and to remotely log in to your server over SSH or RDP. If you are allowing files to be uploaded from the Internet only use secure transport methods to your server such as SFTP or SSH. If possible have your database running on a different server to that of your web server. Doing this means the database server cannot be accessed directly from the outside world, only your web server can access it, minimising the risk of your data being exposed. Finally, don't forget about restricting physical access to your server. 9.SSL SSL is a protocol used to provide security over the Internet. It is a good idea to use a security certificate whenever you are passing personal information between the website and web server or database. Attackers could sniff for this information and if the communication medium is not secure could capture it and use this information to gain access to user accounts and personal data. Use an SSL certificate 10. Security tools Once you think you have done all you can to secure your website then it's time to test your security. The most effective way of doing this is via the use of some security tools, often referred to as penetration testing or pen testing for short. There are many commercial and free products to assist you with this. They work on a similar basis to scripts hackers will use in that they test all know exploits and attempt to compromise your site using some of the previous mentioned methods such as SQL injection. Some free tools that are worth looking at: Netsparker (Free community edition and trial version available). Good for testing SQL injection and XSS OpenVAS. Claims to be the most advanced open source security scanner. Good for testing known vulnerabilities, currently scans over 25,000. But it can be difficult to setup and requires a OpenVAS server to be installed which only runs on *nix. OpenVAS is fork of a Nessus before it became a closed-source commercial product. The results from automated tests can be daunting, as they present a wealth of potential issues. The important thing is to focus on the critical issues first. Each issue reported normally comes with a good explanation of the potential vulnerability. You will probably find that some of the medium/low issues aren't a concern for your site. If you wish to take things a step further then there are some further steps you can take to manually try to compromise your site by altering POST/GET values. A debugging proxy can assist you here as it allows you to intercept the values of an HTTP request between your browser and the server. A popular freeware application called Fiddler is a good starting point. So what should you be trying to alter on the request? If you have pages which should only be visible to a logged in user then I would try changing URL parameters such as user id, or cookie values in an attempt to view details of another user. Another area worth testing are forms, changing the POST values to attempt to submit code to perform XSS or to upload a server side script. Use a debugging proxy to root out vulnerabilities Hopefully these tips will help keep your site and information safe. Thankfully most CMSes have a lot of inbuilt security features, but it is a still a good idea to have knowledge of the most common security exploits so you can ensure you are covered. There are also some helpful modules available for CMSes to check your installation for common security flaws such as Security Review for Drupal and WP Security Scan for WordPress.

Bitdefender Internet Security 2013

Bitdefender Internet Security 2013 Pros BitDefender has an impressive high-scoring test history. It protects privacy on Facebook and Twitter. Cons This internet security suite does not include file shredding or file encryption. The Verdict : 9.55/10 BitDefender is constantly aware and ready to combat threats. Buy Bitdefender Internet Security 2013 Protection Repair Usability Performance in Windows 7 protection tests conducted by AV-Test during the autumn of 2012. Bitdefender Internet Security 100% Compare to the Top 3 Internet Security Suites Software #1 Bitdefender Internet Security 100% #2 Kaspersky Internet Security 92% #3 Norton Internet Security 92% Category Average 80.19% Percent 0 20 40 60 80 100 120 Review Specifications Images Side By Side Comparison Learning Center LIKE OUR REVIEWS? SUPPORT OUR SITE ON FACEBOOK OR GOOGLE PLUS TopTenREVIEWS - Gold Award - Awarded for excellence in design, useability and feature set Bitdefender Internet Security is always aware and on guard. Bitdefender protects hundreds of millions of users worldwide from known and unknown internet assailants. The TopTenREVIEWS Gold Award winner for internet security suites is an effective weapon against the evils of hackerdom. Bitdefender can protect you and your family from invisible attacks from all angles – from the internet, email, social media, USB drives, network-connected devices and chat conversations. After running Bitdefender Internet Security through its paces, we must concur with a statement from Bitdefender's Chief Technology Officer: "We've given the home user product range a striking overhaul, offering sleek, silent defense from today's e-threats," said Bogdan Dumitru, Bitdefender CTO. "The new interface is very easy to use, and the addition of the optional Autopilot feature will meet the demands of those users looking for a hassle-free security experience." The Bitdefender brand logo, the Dacian Dragon-Wolf, declares graphic hostility toward hackers who attack goodness. Half wolf and half dragon, the Dacian Wolf inspired confidence among ancient troops that carried it into battle by striking fear into enemies. Bitdefender's mantra is simple – Awake – meaning that it strives to be relentlessly aware and ready for battle. We find the brand avatar and mantra to be appropriate to the spirit of Bitdefender. If you arm yourself with Bitdefender, you can have confidence in the multiple ways that it protects you. Moreover, when hackers attempt to breach your defenses and encounter a Bitdefender guardian at your gates, they will lose confidence and move on to more vulnerable victims. Performance: 9.4/10 Compare Bitdefender Internet Security Kaspersky Internet Security Norton Internet Security F-Secure Internet Security Trend Micro Titanium Internet Security G Data Internet Security Avast Internet Security BullGuard Internet Security AVG Internet Security Lavasoft Ad-Aware Total Security 9.4 8.3 8.3 8.6 8.1 8.1 7.8 7.2 6.9 7 Click to Enlarge Malware detection is one of the most important aspects of robust internet security suites. Bitdefender’s protection is superior. The software consistently receives awards and certifications from third-party security testers. It demonstrates above-average malware detection rates. One of the reasons Bitdefender is so effective is that it scans all PC communications, both incoming and outgoing. The scans run in real time to stop threats before they infiltrate. German-based AV-Test is one of the most respected third-party test labs. AV-Test has given top scores to the Bitdefender internet security suite for protection. Bitdefender applies three levels of defense against malware. The first level is to check for known virus signatures that Bitdefender has already collected in the cloud and for which there is a known cure. The second level is to detect unknown threats and isolate them in a virtualized environment. Once it has them corralled, the software monitors whether the suspected files attempt to modify certain files, communicate with sensitive areas or produce files that are associated with known viruses. If the virus behaves well in the virtual environment, Bitdefender allows it to operate normally. If it demonstrates suspicious behavior, the application either deletes it or sends it to quarantine. The third level of defense, called Active Virus Control, watches each specific process that is running on the PC. It then checks for any actions that resemble malware. Active Virus Control is different from technologies that monitor executable files when they start. It monitors processes continuously. The Bitdefender Internet Security suite features a two-way firewall. The versatile firewall will automatically adjust its settings to fit your location. An integrated Wi-Fi monitor protects your computer from unwanted attempts to access your network. A disabled firewall will not do you much good, yet it is common practice for gamers to turn off firewall settings to access and run computer games. With Bitdefender’s gamer mode, there’s no need to disable then remember to re-enable the firewall. You will stay protected while you’re gaming. In addition, the gamer mode stops any interference while you’re in full screen mode for videos or presentations. Features: 10/10 Compare Click to Enlarge The Bitdefender Internet Security suite provides an exhaustive list of easy-to-use, helpful security tools for protecting your identity, your children and your PC. When you use a search engine, Bitdefender gives each URL a security rank. The website filter uses specific category definitions to block suspicious sites. You can also restrict, enable and monitor your child’s internet activity. You can configure the parental filters to block or allow websites, IM contacts and emails that contain flagged words or phrases. In addition, you can limit internet and application access to specific times or just give a time allotment to each child. With the parental controls and monitoring tools, it’s easy for parents to maintain control. This security suite can quickly run full system scans, and you can schedule scans as well. Scans do not interfere while you are using your computer; scheduled scans only run when your system is idle. The Scan Dispatcher tool will only trigger a system scan when the PC resource usage falls below a set point. It also has a vulnerability scanner that checks for outdated software and needed Windows updates. Consistent with its multi-layered approach to defenses, Bitdefender includes a free credit monitoring service for customers in the United States. The service provides you with real-time alerts if any changes appear on your credit reports.