Posts Tagged ‘design’

ireland website security

Solutions for Website Security

Irish Web Design are please to announce that they have created a series of packages to provide a high level of security to small to medium business websites.

The packages are designed especially for WordPress based information, blog, news and e-commerce on-line shop websites.

 

barbed wire pattern

 

Irish Web Design described the packages as consisting of the three S’s: Scan, Secure Survey.

The website security measures involve scanning the websites for issues, securing the site and finally setting up a surveillance system to monitor the website in the longer term.

It is estimated that hundreds of thousands of websites around the globe that are running the WordPress software have been infected by malicious software.

Some of the software infects the computers of visitors, who may find a realistic looking ‘Anti Virus Scanner’ pop up on their computer.

The owner is informed that his machine is infected and this software will remove the threats and provide on-going security.

This ‘peace of mind’ only costs a very modest amount, typically $10 to $20.

This is a scam, the programme is not real.

What the criminals who are behind the scam want are your credit or debit card details.

They may wait a long time before they use the information gained to empty your account of funds.

There are many variation on these scams, including straightforward blackmail: you want your site back, you will pay.

Irish Web Design have researched the issue and designed a solution to ensure that website owners can sleep at night.

While there can never be an absolute guarantee as situations can change very rapidly the system is designed to provide alerts to any suspicious activity.

Contact Irish Web Design if you want your website audited and secured.

 

 

 

 

 

 

Solutions for Website Security

bank of america signs

Little and Large Websites Attacked

Little and Large Websites Attacked

The coordinated attacks used to knock a large number of websites offline grew became more powerful in the past months. According to the American company Prolexic who run the world’s largest and most trusted distributed denial of service (DDoS) protection & mitigation service, there has been an eight-fold increase in the average amount of junk traffic used to take sites down.

bank-of-america logo

Chase Bank Logo

citi bank logo

wells fargo logo

Attackers have moved on from just using compromised PCs in homes and small offices to flood websites with vast volumes of traffic, and are now using Web servers, which have vastly more more bandwidth available.

The recent ongoing attack on servers running the WordPress blogging application is constantly seeking new computing power that can be harnessed to form vastly bigger botnets.

Prolexic reported that well-financed attackers  are increasingly able to coordinate with fellow crime organizations in the large-scale assaults.

These types of attacks appear to be here to stay and can only be achieved by having access to significant resources  including manpower, technical skills and an organised chain of command.

The most prominent targets of the attacks have been the America’s largest banks, including Bank of America, Wells Fargo Bank, Chase Bank which at times have become completely unreachable following the flood of traffic.

Prolexic believes these attacks are not individual youngsters flexing their muscles, because the efforts involved in the harvesting of hosts, coordination, schedules,  specifics and the sheer military precision of the attacks suggests the presence of experienced criminals that recruit ‘digital mercenary groups’ to do their work for them.

San Francisco-based CloudFlare’s network was recently bombarded by data sent by more than 80,000 servers across the Internet that all appeared to be running WordPress.

Attackers will enter a legitimate user name along with passwords that are known to be invalid, which, when repeated millions of times overwhelms the servers as they perform database lookups and then report the authentication failure which the system struggles to record it in the internal logs.

The vast increase in applications such as WordPress and Joomla  could become to this decade what the early versions of Microsoft’s Windows XP were to the previous decade. In the 2000s it was easy to compromise desktop PCs and turn them into spam-sending engines or botnets to perform various nefarious acts.

Nowadays using a server that is at least ten times as powerful as a desktop computer can do a great deal more damage.

Recent Irish websites that have been attacked include the websites for the Department of Justice and the website of the Department of Finance.

Little and Large Websites Attacked

Irish Web Design

Magnifying Glass

Web Servers Under Attack

Irish Web Design continue to monitor developments in the ongoing saga of the many web servers under attack.

Eye Graphic

The www.arstechnica.com website carried the following story on the subject in its Risk Assessment / Security & Hacktivism section.

The piece is entitled “Admin beware: Attack hitting Apache websites is invisible to the naked eye”

With the sub-heading: “Newly discovered Linux/Cdorked evades detection by running in shared memory.”

“Ongoing exploits infecting tens of thousands of reputable sites running the Apache Web server have only grown more powerful and stealthy since Ars first reported on them four weeks ago. Researchers have now documented highly sophisticated features that make these exploits invisible without the use of special forensic detection methods.

Linux/Cdorked.A, as the backdoor has been dubbed, turns Apache-run websites into platforms that surreptitiously expose visitors to powerful malware attacks. According to a blog post published Friday by researchers from antivirus provider Eset, virtually all traces of the backdoor are stored in the shared memory of an infected server, making it extremely hard for administrators to know their machine has been hacked. This gives attackers a new and stealthy launchpad for client-side attacks included in Blackhole, a popular toolkit in the underground that exploits security bugs in Oracle’s Java, Adobe’s Flash and Reader, and dozens of other programs used by end users. There may be no way for typical server admins to know they’re infected.

“Unless a person really has some deep-dive knowledge on the incident response team, the first thing they’re going to do is kill the evidence,” Cameron Camp, a security researcher at Eset North America, told Ars. “If you run a large hosting company you’re not going to send a guy in who’s going to do memory dumps, you’re going to go on there with your standard tool sets and destroy the evidence.”

Linux/Cdorked.A leaves no traces of compromised hosts on the hard drive other than its modified HTTP daemon binary. Its configuration is delivered by the attacker through obfuscated HTTP commands that aren’t logged by normal Apache systems. All attacker-controlled data is encrypted. Those measures make it all but impossible for administrators to know anything is amiss unless they employ special methods to peer deep inside an infected machine. The backdoor analysed by Eset was programmed to receive 70 different encrypted commands, a number that could give attackers fairly granular control. Attackers can invoke the commands by manipulating the URLs sent to an infected website.

“The thing is receiving commands,” Camp said. “That means that suddenly you have a new vector that is difficult to detect but is receiving commands. Blackhole is a tricky piece of malware anyway. Now suddenly you have a slick delivery method.”

In addition to hiding evidence in memory, the backdoor is programmed to mask its malicious behaviour in other ways. End users who request addresses that contain “adm,” “webmaster” “support,” and similar words often used to denote special administrator webpages aren’t exposed to the client exploits. Also, to make detection harder, users who have previously been attacked are not exposed in the future.

It remains unclear what the precise relationship is between Linux/Cdorked.A and Darkleech, the Apache plug-in module conservatively estimated to have hijacked at least 20,000 sites. It’s possible they’re the same module, different versions of the same module, or different modules that both expose end users to Blackhole exploits. It also remains unclear exactly how legitimate websites are coming under the spell of the malicious plugins. While researchers from Sucuri speculate it takes hold after attackers brute-force the secure-shell access used by administrators, a researcher from Cisco Systems said he found evidence that vulnerable configurations of the Plesk control panel are being exploited to spread Darkleech. Other researchers who have investigated the ongoing attack in the past six months include AV provider Sophos and those from the Malware Must Die blog.

The malicious Apache modules are proving difficult to disinfect. Many of the modules take control of the secure shell mechanism that legitimate administrators use to make technical changes and update content to a site. That means attackers often regain control of machines that are only partially disinfected. The larger problem, of course, is that the highly sophisticated behavior of the infections makes them extremely hard to detect.

Eset researchers have released a tool that can be used by administrators who suspect their machine is infected with Linux/Cdorked.A. The free python script examines the shared memory of a sever running Apache and looks for commands issued by the stealthy backdoor. Eset’s cloud-based Livegrid system has already detected hundreds of servers that are infected. Because Livegrid works only with a small percentage of machines on the Internet, the number of compromised Apache servers is presumed to be much higher.”

Further relevant articles can be found on the website: http://www.arstechnica.com

wordpress attacked circular 3d logo

Protect Your WordPress Website

One of the most popular content management systems in use on modern websites is WordPress, found on more than 60 million websites around the world.

WordPress has been in the news recently as the subject of a large-scale attack from a huge number of computers from across the internet.  This automated botnet attack was attempting to take over servers that run WordPress websites.

Many experts believe that this current attack is a relatively small scale version of a botnet that will infect computers in the future. The next attack may be vastly stronger and more destructive than what we have seen recently.

Running on the servers that have bandwidth connections that are hundreds or even thousands of times faster than machines in homes and small businesses.

The enormous popularity of WordPress shows its vulnerability in a situation like this, as a result of it’s ease of use is weak security by users.

This typically means that users continue to use the word ‘admin’ as a user name, as this is the default administration account that’s created when you first install WordPress.

Weak passwords may be guessed by the ‘brute force’ attack of a botnet, able to try vast numbers of password combinations in a short space of  time.

For the moment every WordPress user should disabled the default ‘admin’ account in their installation,  and replace it with something else. This may take you out of the immediate danger from the current the attackers.

To create a strong password you need to use at least ten characters with a combination of upper and lower case letters along with some numbers and even some extended characters

The recent attack serves as a reminder to everyone that that security for your WordPress blog or website is something you do need to continue to work on.

What follows is Irish Web Design’s advice on what can you do to make your site more secure. These actions will help to deter such attacks in the future.

Update to the latest WordPress (currently version 3.5.1)

If there is an administrative user called ‘admin’.

Create a new account with a different name, unconnected with the name of your website. Give it administrative privileges.
Give it a strong password you have never used before.
Write these details down in at least two different places.
Sign out of the account.
Sign in as the new user.
Delete the old ‘admin’ user account.
During this procedure, you’ll be asked by  what account should you assign posts to created by ‘admin’ to.
Choose the new account name you just created.

You should also enable ‘two-step verification’ for each user in your WordPress account. As this is a more complex process with additional implications we will carry an article on the subject in the near future.

Irish Web Design would also recommend changing all passwords connected with access to the site, server and database on a regular basis.

As a matter of course Irish Web Design also recommend that all users should install a number of security programmes on all WordPress websites to prevent them being hacked.

In our view, if you adhere to minimum standards of security for your WordPress site it will give you a good level of security and will make it more difficult to hack into your site.

Don’t let the spammers, hackers or botnets destroy your presence on the web. Your site or blog can be secure with a little thought and effort.

Title of article: Protect Your WordPress Website published by Irish Web Design

Athy Tyre Service Website

Athy Tyre Services Home-Page

Athy Tyre Services Home-Page

Athy Tyre Service Website is now live.

Created in restful greens this project was recently completed for Brendan Loughman.

Brendan runs Athy Tyre Services along with M and L Autoparts on the outskirts of Athy at Bennetsbridge, on the Kilkenny Road leading to Ballylinan.

This long established business has a fine reputation for all things automotive.

Tyres from all major brands including Pirelli, Dunlop, Goodyear, Firestone, Michelin, Continental and Bridgestone are supplied, fitted and balanced for all makes of cars, commercials and agricultural vehicles.

The website also has a section on servicing and repairs.

Irish Web Design are responsible for the information website design, copyrighting, graphic design and original professional photography.

Link to the Athy Tyre Service Website

Athy Tyre Services Home Page in full

Athy Tyre Services Home Page in full

E-commerce

E-commerce is defined as being the buying and selling of goods and services by businesses and consumers through an electronic medium. It is most widely considered the buying and selling of products over the internet, but really any transaction that is completed solely through electronic means can be considered to be e-commerce.
There are three categories of E-commerce:
B2B or business to business for example Cisco.
B2C or business to consumer for example Amazon.
C2C or consumer to consumer for example eBay.

It is also called electronic commerce, and some people refer to the sites as shop sites.

Irish Web Design has experience of a wide variety of websites, and specialises in the website design and the Search Engine Optomisation SEO of E-commerce and other websites.

Recently websites have been completed for What Vitamin and Boom Nutrition.

Other websites that contain an element where purchases can be made include Fitness Extravaganza and What’s On Athy.

Follow the links to see how this company integrated the capacity to sell products on the websites.

In some cases the main purpose is sales, for example the What Vitamin site which serves all parts of the Republic of Ireland with a service delivering a wide range of vitamins and related products.

Boom Nutrition specialises in delivering Fitness Nutrition to all mainland addresses in Ireland.

Fitness Extravaganza, or FitEx for short, services competitors who want to enter Ireland’s Premier Fitness Modelling Competition.

Entry tickets for competitors and spectator tickets can be purchased on the website.

DVD’s of the competition can also be purchased online.

What’s On Athy is the website for the South Kildare monthly magazine. An innovation is the Athy Showcase Shop which allows local businesses to sell goods and services without having to invest in their own website.

Different Payment Gateways have been used from AIB Merchant Services, to SagePay and of course PayPal.

QR Codes

WHAT IS A QR CODE?

QR Codes (Quick Response Codes)  are an evolution of the traditional barcodes.
http://scan.me/apps/scan/download/

QR codes can hold significantly more information and are much more flexible.

QR codes can be used for many purposes including to share contacts, links, map locations and much more.

HOW TO SCAN A QR CODE

Open the QR reader app in your phone. ( see below if this is not installed.

Center the QR code in your camera’s viewfinder.

The QR reader will start scanning immediately.
Scanned information will be shown on your phone, without you pressing anything.

If the QR code is a link to a website the site will open in your browser.

If the QR code is a link to a YouTube video, you’ll immediately see video’s image, title and duration.

If the QR code is a geo-location, you’ll see a mini Google Map.

Download free software for reading QR Codes

Android QR Code Apps

scan qr code reader logo

 

 

 

http://scan.me/apps/scan/download/

droid qr logo

 

 

 

https://play.google.com/store/apps/details?id=la.droid.qr

 

iPhone QR Code Apps

 

scan qr code reader logo

 

 

 

http://scan.me/apps/scan/download/

 

optiscan qr reader logo

 

 

 

 

 

 

https://itunes.apple.com/us/app/optiscan-qr-code-scanner-generator/id304099767?mt=8&ign-mpt=uo%3D6

QR Codes

Visit Us On TwitterVisit Us On FacebookCheck Our Feed