Welcome to “Refog” corporate blog.

We are developing programs to monitor user activity of home (Personal Monitor) and office (Employee Monitor) computers, as well as to control usage of your children’s computer (Time Sheriff).

Employee Monitor: advanced settings

24 April 2012

errorFrom time to time, we get contacted by people complaining that they cannot connect to a remote computer using Mipko Employee Monitor. Unfortunately, such situations do happen because of the differences in network architectures, computer settings, user permissions and other parameters. We have compiled a list of recommendations that will most probably help you solve your problem and successfully establish a connection. Here they are.

One.

Make sure that the script is installed and launched on monitored computers (just in case you missed something). The following instruction explains how it can be created and installed.
The work of the script can be tested in the following way:
If the script was installed, you will find a folder called C:\Documents and Settings\All Users\Application Data\MPK (in Windows XP) or C:\ProgrammData\MPK (in Windows 7) containing logs and the executable file of the program. If the program is running, it won’t be possible to delete or move the executable file (with the *.exe extension).

Two.

Try adding the target computer using its IP address instead of its network name.
Try navigating from the observer’s computer to C$, the hidden shared folder of the client system being monitored and make sure it is accessible under the current user without errors or issues of any sort. If it’s not, try looking for a possible reason and fixing it.
My Computer > address bar > \\IP address or name of the client computer\C$ > Enter
If it didn’t help and didn’t solve the problem, carry on with the instruction.

Three.

Make sure that the DWORD RestrictAnonymous key is set to zero in the HKLM\SYSTEM\CurrentControlSet\Control\Lsa registry node on all monitored computers. This is a recommendation from Microsoft.
In Windows 7, disable the “Password protected sharing” option:
Control Panel > Network and Internet > View network status and tasks > Change advanced sharing settings > Home or Work (current profile) > Password protected sharing > Turn off password protected sharing.

Make sure that all computers are in the same workgroup or domain. This is important – if they are not, it may cause problems.
If you have completed the steps described above, restarted the computer and the problem still persists, please contact our technical support service, we’ll do our best to assist you.

Jailbreaking Apple’s latest gadgets

23 March 2012

By the day after release of Apple’s new iPad 3, hackers had already found three ways to jailbreak the OS of the tablet device. This represented a drop of six days compared to the time necessary for jailbreaking the iPad 2 after launch.

Hackers also dryly noted that out of Apple’s entire device lineup, the best-protected device is also the very cheapest one: the Apple TV 3.1 television appliance.

Why? Most of the features in Apple’s iOS operating system, which is used on all of the company’s mobile devices, are simply discarded and disabled on the Apple TV. This reduces the “area for attack” available to hackers, thus creating significant obstacles for them.

Although the newer version of the Apple TV was ultimately hacked nonetheless, the jailbreak tool did not catch on with users. It is usually the case that Apple gradually updates the operating system with the features that users had hoped to gain through jailbreaking their devices.

Study: Mobility against Security

21 March 2012

mobile devicesAccording to a research called “The Impact of Mobile Devices on Information Security” published by Check Point® Software Technologies Ltd., the number of mobile devices connected to corporate networks doubled in 2010-2011. Half of these devices contain confidential information.

The management of 70% of the surveyed companies are confident that it is the use of mobile devices that results in the increased number of data leaks. This mostly happens when devices containing corporate emails (80% of cases), client databases (around 50%) and corporate passwords (around 40%) get lost or stolen.

Corporate users are actively embracing mobile devices and services, thus creating a lot of problems for IT experts responsible for the security of corporate data. Modern standards do not cover new security threads, and yet it’s not reasonable to completely stop using mobile devices, since they give users a number of advantages that boost their performance and provide them with quick and convenient mobile access to corporate resources.

Check Point report highlights:

  • In 94% of companies, the number of mobile devices connected to corporate networks has increased.
  • In 78% of companies, their number has more than doubled over the past two years.
  • The most popular mobile platforms used in corporate networks are:
    1. Apple (30%)
    2. BlackBerry (29%)
    3. Android (21%)
  • 43% of companies believe that Android-based devices pose a serious threat to their information security.
  • The key threats undermining information security are:
    1. Lack of knowledge in the information security field among corporate users (over 70%).
    2. Use of mobile devices for web browsing (61%)
    3. Use of unprotected wireless connections (59%)
    4. Device loss of theft (58%)
    5. Downloading of malicious software to mobile devices (57%).

Update to version 7.2.0.1443

13 February 2012

In this program update there are not that many innovations, but it’s worth writing about it as well. It is made almost completely on the basis of joint work by programmers, the technical support department, and actual users of our programs.

In all the programs, we added the feature of capturing user’s messages in the VKontakte (vk.com) social network. Many users have asked me for this for a long time now.

The Ukrainian language was added to the programs’ interface. The translation was done by one of our users, so thank you very much to him.

The Ukrainian language

We are continuing to work on improving the encrypting system for logs in Employee Monitor and Terminal Monitor. In extremely rare cases, it works incorrectly and greatly slows down the work of the program.

Thanks to reports like this from our users, we were able to solve the problem. In the next versions of the programs, we will be able to get rid of it completely.

USA: 10 years of prison for leaked data

26 January 2012

Reuters reports that charges have been pressed by the US government against Bo Zhang, a 32-year-old China-born programmer. He is accused of illegally copying the source code of government-owned software that cost $9.5 mln to develop, to an external hard drive.

When the leak was discovered, the programmer was a part-time employee of the U.S. Federal Reserve Bank, which helped him get access to the source code of the software developed for the US Department of the Treasury.

The compromised program, called Government-wide Accounting and Reporting Program (GWA), was developed for monitoring the money transfers made by the US government and reporting to a variety of government agencies and organizations.

Once the leak was discovered, the bank initiated an internal investigation and handed the results over to the police. As the result, Bo Zhang was arrested on January 18.

The FBI did not find any signs of espionage and he was released on bail. The trial will take place on February 17 and if he is found guilty (he is being charged with the theft of government property), he may be sentenced to up to 10 years of prison.

France was secretly intercepting the British government correspondence

28 November 2011

France was secretly intercepting the British government correspondenceDuring his speech at the McAfee Focus Event in London, David Blunkett, the former British Minister of Internal Affairs, provided some details about the 2000 negotiations with Nicolas Sarcozy (the French Minister of the Interior at that time), where the latter admitted that France had been intercepting electronic correspondence of the British embassy.

The future president of France thereby confirmed the fact of active hi-tech espionage on the state level. These days, virtually all government agencies use strong data encryption for all correspondence, especially for messages sent abroad.

During his address, Blunkett also raised the topic of “advanced persistent threats (APT’s), which usually target the IT systems of public organizations and government agencies.

One of the characteristics of APT’s is that hackers disguise their activities using the tools already present in the system being attacked, exploit commonly used ports, mask their activities as actions performed by standard applications or even hide their control communications in HTML comments, which allows them to capture highly-confidential and secret information for prolonged periods of time.

User monitoring: Facebook’s new patent

28 November 2011

facebookSome time ago, Facebook got involved in a new scandal. The hype was based around the fact that HTTP cookies saved by Facebook on users’ computers remained there even after they logged out of the social network, thus casting a shadow of suspicion on it developers and created an impression that they could be monitoring users’ activities on other sites.

On September 25, Facebook officials sent a statement to major mass media assuring the public that they were not monitoring users’ activities on other websites.

However, on September 22, the US Patent and Trademarks Office received a patent application for a technology that made it possible to track user’s actions outside a social network.

It’s clear that “to patent” does not equal “to use”, but hardly anybody can guarantee that the social network will not get such functionality in the future.

Spying scandal in Germany

10 November 2011

Chaos Computer Club (CCC), a Germany-based hacker group, published a proof of the use of spyware by the government, which resulted in a serious scandal on the highest level.

The spyware mentioned in the publication was found on a laptop that belonged to a person who was suspected of illegal export of pharmaceuticals. The program was allegedly installed during a customs inspection at an airport.

This program captures the URL’s of visited websites and email communications and then sends the collected data to a remote server, presumably outside the country. Besides, it allows the operator to upload and launch any applications on a remote computer.

Joachim Hermann, the Minister of Interior of Bavaria, confirmed that state authorities in this land had been using spyware since 2009, but refused to provide specific examples. In his opinion, this practice in not in breach of any laws, although this issue is subject to further discussion. Authorities from three other lands (Baden-Württemberg, Brandenburg and Niedersachsen) also confirmed that they had been using similar software.

In response to the furious public reaction, some high-profile authorities were forced to provide comments on the situation.

Germany’s Minister of Justice, Sabine Leutheusser-Schnarrenberger, and Chancellor Angela Merkel demanded that a thorough investigation of the incident be conducted. The result of this investigation should be a mechanism aimed at protecting the citizens’ rights to privacy.

Therefore, Germany’s laws related to the use of spyware may change considerably in the nearest future.

ZoneDefense: advanced mobile protection

10 November 2011

ZoneDefenseAirPatrol has presented a new wireless security technology called ZoneDefense. This system uses a new unique approach to the prevention of corporate data leaks.

This a narrowly focused technology that prevents data leaks through mobile devices and applications. ZoneDefense integrates into the structure of a protected building (with its elements being placed in every room) and detects the location of any mobile device with 6-7 foot accuracy.

However, this is not all the system is capable of.

Not only does it allow to find devices within a protected building, but can also make them work according to system-wide rules. Depending on the rules, ZoneDefense can either allow or block the work of both devices and specific mobile applications using a number of parameters: device ownership by a specific employee, type of application, movement direction and even proximity of other devices.

This system can also set off an alarm notifying the security service about a possible data leak or detection of a suspicious device in an unauthorized area.

Google: online safety guide for children

10 November 2011

family safetyAccording to a research conducted by the Internet Development Fund, children in Europe and the NIS states usually know more about the Internet than their parents do.

From the one hand, this is a positive and logical thing. From the other hand – we don’t really know how children understand the basics of online security. Regular incidents involving Internet fraud and harassment prove that the problem is very real and the level of online threat awareness among teenagers is very low.

You can try to shield your kids from such threats in many ways, but you must be ready to face the fact that an Internet-savvy teenager won’t have any problems finding a workaround. And that is why you, as a parent, will have to explain the basics of online security to them.

Google has published a guide for parents and teachers that explains how online dangers can be avoided and how the rules of online conduct can be efficiently communicated to minors. All of these materials have been published as “Family Safety Center”.

The guide contains articles written by Google and other companies working on the problems of online security for children.

However, we should not forget than no technology, even the most advanced one, will ever be able to replace parental control and proper upbringing.