On the Smoke Signals Website

Attention Parents:

Home Computer Security information - Please Take Note !

Parents, some students at the High School have recently discovered a free utility on the internet that will allow a user to pull off password information from any computer. In true form, this information has quickly spread through the High School and Middle School student body. This site, for $21, will email the customer a list of all passwords and IDs used to logon to a PC where the utility has been run. This apparently started at home where an enterprising student wanted to bypass parent restrictions (by being able to log on as the parent).

Basically, this site allows the user to create a diskette or CD with which to boot the machine. It then copies the encrypted information to a diskette. The user can then upload this file to the website at any time (and on any other machine). Within minutes, it provides the IDs and passwords of every person that logged on to that system (only the IDs and passwords used to logon to the PC, not any application or web site ID or passwords).

To protect yourself from this, you need to do the following:
1. (Get someone that knows computers to help you with this step) Modify the BIOS (hardware settings) to turn off the capability to boot the local computer with a diskette or CD. Apply a password to the BIOS so others cannot do this (the utility does not compromise this password).
2. Be sure your login IDs and passwords to sensitive applications (like credit cards and online banking) are different from your computer login ID and password.
3. Change your passwords regularly (especially after you have completed step 1).
4. Be sure to use the safest passwords possible. Ideally, the password would be longer than 12 characters (that wasn't a typo... passwords of 13 characters or more would not have been decoded by this utility as it takes too much time to try to decipher that many characters). Include letters, numbers, symbols AND mixed cases in your password. An example would be: iWu2haxsD@y2d@y One way to create a password like this is to think of a sentence that has at least 13 words, and then substitute numbers/symbols that resemble letters (like a 3 for an E or an @ for an a) for the first letter of each word (and that becomes your password. e.g. "Have a happy day today" would become H@hd2). If you simply can't think of a password of 13 or more characters, at least include numbers and symbols and mixed cases.

It is also HIGHLY recommended that you place your computer in a populated/busy area of your house (like the family room), where you can see what is happening on the computer at a glance. While you may not always understand what they are doing, your presence will help to deter inappropriate use. Also, limit computer time for all children. When we have had problems with budding hackers, we find it usually happens when they are completely unsupervised (no one is at home, or it is happening during the wee hours of the night when everyone is asleep). If you must, remove the power cords, keyboard and mouse, and lock them in a safe place to enforce this.

I am firmly convinced that most hacking starts as a result of a strong curiosity and affinity towards technology. They just need guidance and supervision to channel this interest in a positive direction.

Arline L. Liegel
District Technology Coordinator
Indian Hill Schools - Cincinnati, OH

I pesonally think that posting this is below the belt. Not only that, but it's stupid to prevent CD and disk boot up. How will you install a new OS or fix a problem if the HDD crashes? Anyway, somebody could always boot from a USB drive. Plus, it's pretty easy to reset the BIOS password: just open the computer and set the "reset password" jumper. Most people couldn't do it off the top of their head, but instructions are easily available online. Finally, why would anyone want to hack a password that way anyway? There are so many better ways of breaking into a computer than paying $21 to get the password. Pfft, these people are stupid. I need to publish a "Window's Hacker Guide" at school. That's what they get for posting about this.