Da Shredder Do Good

Sorry. That's a joke that only a few of my older readers will catch. Many years ago when "easy-open" beer bottles were not at all easy to open, one bottling company produced an advertisement making fun of that fact. It starred a "professional" wrestler opening a beer. When, after a great deal of grunting and sounds of great efforts being made, it was opened, he stated, "The Crusher do good!"

That does have a connection to today's topic, deleting and/or erasing files from one's computer drive. There are various degrees of deletion and erasure. The least secure is simply deleting a file by sending it to the Windows Recycle Bin and clicking on "Empty Recycle Bin." This action only erases the address (a few bits) of the file on the drive such that the computer no longer recognizes it as being present. The body of it remains. It can easily be found by someone with a little knowledge of computers and a program to view what is on the entire drive.

At the extreme opposite end of the security spectrum would be having a bit of thermite or a huge degausser installed in the computer set to destroy the entire hard drive if certain conditions are met. This method would be for serious hackers, intelligence agencies, those with child porn on their machines, or any of you who really don't want your high school nickname known, and are willing to have a lump of smoldering plastic and metal on your desk to prevent it.

In many cases, simply deleting a file is enough. If you don't care that there are retrievable remains of all your blog posts, emails to Aunt Edna, or grocery lists, fine. More sensitive information deserves more care, at least encryption and more complete deletion when you are done with it. At one time in the past, simple deletion was enough because people who wanted your data were not so common and ways to get it were not so sophisticated. Unfortunately, that has not been true for several years, so it is largely up to you to protect it.

A recent article by Linda Martin-Peoples on MakeUseOf.com reviews or mentions in the comments section, various free file, folder, and disk deletion programs. FileShredder seems to be a very useful free program. Another program mentioned in the article is a trial of a commercial program, not true freeware, and is not listed here. Data Shredder is available free from CBL Data Recovery Technology, LLC, a Canadian data recovery company. I highly recommend that you read the article on this link to their site which explains, in understandable terms, what the different levels and types of data destruction involve. There are many free file shredders available at various sites around the web. I use Eraser, parts of Crap Cleaner (which is again available at the linked site without the other software recently bundled with it,) and "other methods." There are some programs I have not listed because they are completely destructive of all data on a disk, and I don't believe any of my readers would need such an ability. If you are going to donate a computer to charity or dispose of one, contact me and I will send you the names and URLs.

Other caveats apply to this type of application. Be certain that you trust the source of any freeware you download. Open source sites with GNU licenses (like sourceforge.com, etc.,) large companies giving away a freebie to get you to buy other of their commercial software, and corporations giving away updates, add-ons, templates, etc., to their own commercial software are most often safe. The other "It seems too good to be true" sites frequently prove that old maxim to be true. The second caveat, specifically about file deletion software, is to know what you are doing! If you do, go ahead. If you have any doubt, don't do it. Ask someone first. When the files are gone, they really are gone unless you are willing to take the chance that a data retrieval company, charging $600 to $1000, might be able to get it back.

This article is presented for general educational purposes only, and does not constitute a recommendation or bad review of any particular company or bit of software. It is not all inclusive, and there are many other good and bad programs out there.

Peace, Doc

Copyright © 2008, Thomas A. Blood, Ph.D.

"The word 'free' can have multiple meanings." - Wikipedia

Storage and Backup of Clinical Records

Clinicians should all be aware of the necessity of keeping secure and private clinical records. A major problem is where to store them. I have been engaged in a seemingly endless quest to find places to put my "stuff" following the sale of a large house in a rural-suburban area and the subsequent move into a much smaller apartment. This compacting process has included such trivial efforts as discarding standard sized Jewel Cases and using either the slim-line type or paper or vinyl sleeves to store CDs and DVDs. I have purchased a very large capacity but small sized Maxtor outboard hard drive. Along with efforts in the computer area, I have given away, donated, discarded, or sold items such as a breadmaker, fine, unused cooking equipment, antique furniture, and half my "wardrobe." The latter was comprised primarily of jeans with holes in the knees and flannel shirts with gaping rents at the elbow, so not much loss there. I have shredded many records and plan to store client records in .PDF file form soon. I had tried the free CutePDF Writer and free Converter and found them to be the best for my needs among the various types of .PDF programs. I liked them so much, really, that I purchased the CutePDF Pro version which included the CutePDF Form Filler for $49.95. Among the many other features provided in the Pro version are the ability to scan to PDF (scan your session notes directly into a PDF document,) the ability to FTP upload the document (for file sharing or for online storage,) and most important to compliance with HIPAA requirements, the ability to encrypt the document at a 40-bit or 128-bit level. With the Form Fill portion, one could easily produce a standard intake or interview form, save to PDF, encrypt it, and be compliant in storing it online, burned to disk, or saved on a hard drive. I'm sure by this point I must seem like I am doing a paid advertisement. I am not. Certainly there are other similar programs available, but I have used this one and am thoroughly satisfied with it.

Another aspect to consider when using any computer to produce important documents is the absolute certainty that it will crash or die, taking all your records with it, at the most inconvenient possible time. The answer to this is backup, backup, backup! I have had enough computers quit without giving the required two weeks notice that I have learned this lesson several times over. Again, I have tried and accepted a method to insure against this disaster. I use a Maxtor OneTouch 4 Plus 750 GB external drive which can be used with either a USB.2 or a FireWire 400 connection to the computer. A review of this drive by PC Magazine staff rated it very good and states that the bottom line is; "The Maxtor OneTouch 4 Plus exists as extra storage, but it's really there to save your butt. The next time your system crashes, this drive will get you on your feet again." The drive comes in 250, 500, and 750 GB models, with a very recent release of a 1000 GB (1TB) model, made by pairing two 500 GB drives in one case. One can store the usual documents, pictures, music, and the like on any of them. This series of drives also backs up everything on your computer, including the Operating System, to restore to a new drive in case of a catastrophe. Again, I know that there are similar drives and programs that allow the same types of backup, but after obsessively studying the specifications and abilities of everything I could find with these capabilities, this was my choice and it has worked well.

Backing up only files of whatever type can be accomplished by burning them, in encrypted form, to CD or DVD. There are many programs that will do this efficiently and effectively. I use Roxio's Easy Media Creator 8 (it has advanced to Easy Media Creator Suite 10 recently) and find it more than adequate to do what I want it to do.

Finally, there is online storage for files. I trust it enough for blogs, songs, pictures, and relatively unimportant documents. However, having had my EIN and SS numbers with all other personal and business information "lost" by a government agency, I am less than enthusiastic about the security of information stored anywhere not directly under my control. If you have a Google account and use the Firefox browser, there is an add-on available called G-Drive that allows one to store up to about 5 GB of information online free. A number of other companies offer free and paid storage with varying sizes, charges, and layers of security. I will simply mention MediaMax which offers 25 GB of free storage and increasingly larger amounts for increasing fees.

Until I write next, I'll be trying to force myself to part with my dissertation data (collected over 30 years ago) and deciding what to do with the toy airplanes with 16 foot wingspans. Even the cats seem a bit anxious.

Peace, Doc

Copyright © 2007, Thomas A. Blood, Ph.D.

Keyloggers and Viri and Rootkits, Oh My!

In the last post, I ranted about rootkits being planted in consumers’ computers without their knowledge by unscrupulous corporations or by hackers with even less honorable motives. I vented my displeasure with a corporation but did not give any information about what one can do about a rootkit. To remedy that oversight I embarked on a quest for some free software that will detect their presence. I shall try to rectify the omission in this episode.

It has been written that rootkits and keyloggers hide quite well in the deep recesses of your computer’s innards, often to the degree that excellent commercial software cannot find them. I found two anti-rootkit applications and one keylogger sniffer.

AVG, an excellent commercial security software company, offers three security software applications that are free for the downloading. The best known is their free anti-virus program, but they also offer an anti-spyware application and a rootkit detector. All three are available here.

Sophos Software also offers free anti-rootkit software, a threat detection test, and an application discovery tool in addition to their commercial line of security software.

One of the stranger freeware security tools I found, the SnoopFree Privacy Shield, is a paranoid and compulsive little program that detects any application that could be a keylogger or take over your browser, displays what it is, what it is doing, and asks if you wish to allow it. I found it to be something of a revelation that it classified Google Desktop as a serious threat and desperately tried to convince me not to allow it to function. This program for Win XP is worth installing, if only to see which applications are paying attention to what is being typed on your keyboard.

An updated version of Check Point’s free ZoneAlarm Security Firewall has just been released and is certainly worth using.

Belarc freely gives its Advisor application that lists all the software installed on your computer, for non-commercial purposes only. This app lists every piece of software installed on your computer, along with patches, identification numbers, version numbers, and much other valuable information. This program has been installed on every computer I have owned since 1995.

Finally, EmiSoft’s a-squared free anti malware program (Anti-Trojan, Anti-Worm, and Anti-Spyware) is available, as is an Anti-Dialer program.

When you try these programs, as I have, please give consideration to purchasing the full featured versions or making a donation to the software’s author if you like them.

Peace, Doc

Copyright © 2007, Thomas A. Blood, Ph.D.

Sony Does It Again

I am including this post from another of my blogs as it may have compromised a clinician's computer or do so in the second round of rootkits. Especially troublesome is the information that one of the products that installs a rootkit is not a CD, but a USB fingerprint security device

Once upon a time in the not too far distant past I really liked Sony products. I still do. I have Sony tape deck, receiver, CD/DVD player, pocket recorder, and was drooling over several of their high-end cameras, but I have resolved never to buy another of their offerings because of their corporate behavior.

In 2005 there was a Sony BMG scandal in which rootkits were hidden in over 100 of the CD products manufactured and sold by them. When the customer played the "copy protected" "XCP" CD, a rootkit, otherwise known as spyware or malware, was installed in their computer without their knowledge. It interfered with the way in which Windows systems play CDs and opened several security holes for viruses to enter the unsuspecting owner's computer. Rather than go on at length here, I refer the reader to the wiki link above, for a thoroughly researched and well written explanation of the problem and the various electronic, ethical, and legal ramifications of their ploy. The first time, I was relatively quiet about it, but made my resolution and have abided by it.

Now they have done it again! "... F-Secure's Deep-Guard software has detected rootkits in more software distributed with Sony products." In my opinion, this goes beyond the point that I can simply shut up and not mention it to others whose computers may be affected. They not only did it, but they did it poorly in an attempt at security through obscurity. The TechRepublic Forum post I read most recently on this subject found many others with the same feelings about Sony as I have developed.

*Sigh* At least I'm not the only one who became really cranky over this.

Peace, Doc

Copyright © 2007, Thomas A. Blood, Ph.D.

"Experience is the best teacher, but the tuition is high." - Norwegian Proverb

NanoScan and TotalScan

There are a few good, free, web based applications out there amidst all the crapware. I used Panda Software's computer-based anti-virus program for a year some while back and found it to be satisfactory. Not perfect, but good. That was at a time when many of the viruses, trojans, and worms were coming from the area of the world in which Panda Software is located. My assumption at the time was that they would therefore be the first AV company to encounter many of the new threats "in the wild" and the first to develop new countermeasures. It seemed to be a good assumption. The only drawbacks I encountered at that time were a somewhat unappealing user interface and a very aggressive advertising program. Panda was one of the "other good commercial AV programs" to which I referred in a previous post on free AV protection.

When I evaluate a program for my own use I quickly head in the opposite direction from AV and other security programs that immediately do a scan, find 1,284 possible infections on my computer, and warn me of the grave consequences of not purchasing their software or services immediately. When I found and tried Panda's nanoscan online scan it quickly had a look at my computer after I allowed it to install an ActiveX application. It reported that it found no viruses and that my other security programs were up to date. Hmm. Could it be true?

After one has scanned their computer with nanoscan, a pitch is made for totalscan. It is stated that this version can be used in either “brief” (about five minutes) or “full” (about an hour) modes. One has to sign up with an email address and a password for the free totalscan. I did so and allowed another ActiveX to run. This action started the download of a short program that literally took almost three hours to complete on a dial-up Internet connection. When this process was completed, totalscan found 10 cookies that I knew were present and showed a large red button labeled "disinfect." I hopefully pressed it. The next screen informed me that I must be a member of totalscanPRO for anything to actually happen. Technically, Panda delivered exactly what was promised, a scan. I am so freaking gullible that I must be a relative of Wily Coyote.

The purchase page even insisted that I was from the UK and wanted payment in pounds. I'm afraid I cannot recommend nanoscam, totalscam, or totalscamPRO. Some might want to take a look at Panda's relatively non-technical descriptions of crimeware, hoaxes, rootkits, and the like. Otherwise, it did nothing that the previously listed freeware did not do except leave me with junk to clean out of the computer and two or three hours of subvocal swearing which I must attend to. Despite my current displeasure, I would still state that Panda's programs and services are probably in the class of "other satisfactory commercial security software." I'm glad I used a throwaway e-mail address, though.

Peace, Doc

Copyright © 2007, Thomas A. Blood, Ph.D.

"Dammit!" - Doc

Security Software

Most mental health professionals would agree that we have a duty to keep confidential our clients’ PHI. This seems especially true if we keep that information on computers that can be lost, hacked, or subject to viruses of all kinds.

I recently had, and am continuing to have, an experience of possible identity theft. I did nothing to cause it or to leave myself open to that attack. Stupid things happen. A portable drive with a database of providers was lost or stolen. The VHA wrote to notify me and to offer a year of free credit monitoring and fraud alerts. As most of my personal information including SSN, EIN, name, address, and all the rest was on it, I accepted their offer quickly. My suspicion is that a less experienced employee or an intern copied it to a thumb drive to work on at home. The information was obtained from the Social Security Administration’s database of mental health providers without my knowledge or permission, to be used in a provider demographics study. As a client would feel in a similar situation, I am concerned, anxious, and feel that someone is responsible for potential harm to me. To the VHA’s credit, they immediately admitted their loss and offered some protective measures. Of all the times that I believe my personal information may have been lost, stolen, or compromised this was the only time I was notified.

We owe our clients the best security we can provide. Probably the best security software available to the public is produced by Norton/Symantec and McAfee. They are good and their respective prices reflect that. Many other commercial security software brands are available and usually, as good as the two named, but possibly not as comprehensive.

I have found free versions of some lesser-known software brands available that have proven as effective, in combination, as one of the major manufacturers’ software suites. AVG offers free versions of their Anti-Virus, Anti-Spyware, and Anti-Rootkit software. As far as I am currently aware, their Anti-Rootkit program is the only free rootkit software available. I use all three. CheckPoint Software’s ZoneAlarm Firewall is a well-known and effective free security application that I also use and rely on. Spybot-Search & Destroy is a very effective free “donation-ware” anti-spyware application. I also use it with confidence. LavaSoft’s Ad-Aware-2007 is a free adware search and removal application. It has very recently been updated and apparently did not install well on my computer. Its past versions have been quite useful and worked perfectly in combination with all the other free programs listed. Microsoft also offers free anti-virus and internet filters, as well as updates to your operating system. I use Microsoft Update, Windows Live OneCare safety scanner, Windows Defender, and the Malicious Software Removal Tool. All of the Microsoft tools may be found on the single Microsoft link appearing above.

These are some of the best free security programs available. I recommend them with some caveats, however. I am making recommendations based on my personal use of Microsoft’s XP Pro and XP Home operating systems and cannot generalize to other OSs. If you do not use these links to obtain the software, be certain that the providers and spellings of the program names are exactly the same. There are imitators using names very similar to the good software that may contain malware or be malware themselves. Finally, if you like the software, please consider purchasing their commercial versions. Be careful out there.

Peace, Doc