Here’s the article:

Hack Attack

So who would you like to hack today? A bank, a website, a corporation or perhaps a government agency that’s rubbing you the wrong way? The hacktivist group LulzSec is taking requests. Or maybe you’d like to get your hands on some stolen credit-card accounts to boost your personal spending level or purchase some malware that will divert a business’s payments from its vendors to you. A malware seller called Zeus not only can do that but also provides customer support. Hacking has become a service and entertainment business — and in a quantity and at a quality never before reached.

Hacktivists, pranktivists, idealists and malware coders are oozing past the circa-2000 network-security gates of corporations and governments with ease. Among the biggest hacks was the one that brought down Sony’s PlayStation Network. Some fingered the politically motivated group Anonymous, and authorities in Spain have arrested several purported members. But Anonymous has said, Not us.

When Sony announced that it had finally restored service, the gang of merry hacksters called LulzSec began to trample through its websites, including Sony Pictures. LulzSec, which makes a point of pointing out holes in Web security, used a hack called an SQL injection, then tweeted about it: “We accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks?” It has since broken into gaming companies such as Bethesda Softworks and Minecraft. It used a hack called a distributed-denial-of-service attack to lock up the CIA’s website; it accessed account information from Citibank.

LulzSec may be the headline hacker, but it’s not the most malevolent. The black-hat, criminal side of the practice is booming by adopting a similar approach. Cyberthieves have shifted their focus to social networks. Instead of attacking corporate firewalls head-on, they are breaching corporate sites using social engineering, convincing someone within a company that an e-mail is from a friend or colleague. It’s a technique called spear phishing: the idea is to identify vulnerable targets — say, someone in human resources or finance — and, through them, burrow into corporate networks. They are feasting on small and medium­size businesses like wolves on lambs.

There is also a real cyberwar being waged by nations. Reports of cybersecurity incidents from federal agencies have increased 660% over the past five years, to 41,776 in 2010, according to the Government Accountability Office’s information-security-issues director. The networks of the Department of Defense (DOD) are probed millions of times every day. More than 100 foreign intelligence agencies have attempted to penetrate DOD networks or those of military contractors — attacks characterized as APTs, or advanced persistent threats. At least one got into the Pentagon via Lockheed Martin by cracking the RSA security token, the random-number-generating device that many companies use for secure access to computer networks.

To experts, this is just another sign that the older technology that protected IT is passé. “User-named passwords are breakable now. They weren’t when they first started,” says Bill Conner, CEO of Entrust, an IT-security firm. “Tokens have been around a long time. One lockmaker has now been breached. Even tokens aren’t good against some of the new-age cybercrimes.”

The New Threat Matrix
It adds up to an entirely different threat matrix bubbling up on the Web. The hacker community that once operated in its dark recesses has broken the surface, embracing social networks and exploiting them to expand in all directions, legal and otherwise. “What we are seeing is beyond a technical improvement,” says Dave Jevans, chairman of the Web-security firm IronKey. “They have a social element to bring people together [via the network] to create more sophisticated attacks than we’ve ever seen. That’s what makes it accelerate.”

And it’s not just Nigerian spammers and post-Soviet computer jocks anymore. In the past quarter, the IT-security company AVG traced hack attacks tied to about 700 ­command-and-control servers — servers that take over computers infected by botnets — used by various hackers around the world. “About 30% of the hackers were in the U.S.,” says CEO J.R. Smith. “This is a shocking experience to see the data being stolen — medical data, business data. The volume of data being stolen is constantly increasing.” So is his business, since the thieves are also expanding into cell phones. Smith says his company blocks 10,000 malicious mobile-app downloads every day.

LulzSec and Anonymous have been proving with alarming regularity that the data we’ve entrusted to corporations and institutions isn’t as safe as we’d like. If information privacy wasn’t our first concern, it’s now in the top slot. Anonymous evolved from the fringy website 4chan, where posters frequently signed in as anonymous, and gained acclaim as the hacking force that attacked MasterCard, Amazon and PayPal for canceling Wiki­Leaks’ accounts after WikiLeaks released a trove of U.S. diplomatic cables. LulzSec is thought to be a splinter group of former Anonymous members.

LulzSec’s name is a play on the texting abbreviation LOL, as in laugh out loud, which is what LulzSec has been doing at the networks (it claims to do it “for the lulz”) that in its view aren’t protecting users. Its members are skillful enough to hack into an FBI affiliate site and, according to LulzSec, leak its user base as well, always with a tweet. When an IT-security firm offered $10,000 to anyone who could hack its website, LulzSec did it — and refused the money.

But it seems LulzSec might be shedding its Robin Hood persona in favor of more nefarious activity. Recently it announced via Twitter that it is teaming with Anonymous to steal and share data. In announcing Operation Anti-Security (#AntiSec), LulzSec stated plans “to steal and leak any classified government information, including email spools and documentation. Prime targets are banks and other high-ranking establishments.”

In a missive it released after its 1,000th tweet, LulzSec explained a bit of its philosophy: “Yes, yes, there’s always the argument that releasing everything in full is just as evil, what with accounts being stolen and abused, but welcome to 2011. This is the lulz lizard era, where we do things just because we find it entertaining.” In the meantime, counterhackers are vowing to track down LulzSec’s membership.

Sony didn’t find hacking particularly entertaining when its PlayStation Network was shut down on April 20. For more than a month, Sony had to take the network down, leaving about 100 million players without their fun and no doubt forcing parents to pay more attention to their children, and vice versa, until the company got it going again at the beginning of June — at a cost of $173?million. The PlayStation Network had barely returned to action when LulzSec barreled into many of Sony’s more than 10,000 websites worldwide. Yet when Sega’s site was hacked by an unknown interloper, LulzSec signaled that it would track down the culprit.

LulzSec’s beef with Sony — indeed, with just about everybody — is that the company’s Internet security isn’t good enough, so it must be named and shamed. Within Sony, the reaction was as much frustration as anger. It was not as if PlayStation owners were launching cruise missiles at endangered animals. The PlayStation Network was a community that willingly shared information; it depended upon a certain level of civil behavior. Nonsense, said LulzSec.

The Black Hats Are Winning
In that same release, LulzSec also warned the public about what it wasn’t noticing: the everyday hacking of banks, businesses and individuals, incidents that the IT-security experts concede are growing rapidly. Black-hat hackers are adapting social networks to establish an evil ecosystem while exploiting its vulnerabilities to steal data and money. Their tool kit includes social-engineering techniques that dupe you into coughing up passwords. Their malware is getting better: botnets (networks of infected computers) are growing, as are “man in the middle” schemes that redirect your Web traffic.

It’s a new plug-and-play environment as hackers specialize, link with other specialists as needed and offer a variety of goods and services. You don’t even have to be a hacker to use some of the available products. There’s 24/7 customer support. Malware consortiums like Zeus produce botnets that let you invade and infest computer systems. You can obtain specific parts of botnet code that you can customize for your own use to hack individual bank accounts. Need a “mule” to set up an account to transfer stolen money into? That service can be provided too. “There’s a whole supply chain here,” says AVG’s Smith. “The guys who develop it, update, use it, and people who have to get the money. It’s hard to find the guy.”

Not that the cops aren’t looking. Zeus suffered a major hit when the U.S. charged 70 people with involvement in the cybercrime ring in September 2010. Its response was to merge with SpyEye, another botnet maker. The point, as with any other merger, is to improve efficiency and profits. The combined Zeus-SpyEye, for example, is making an even more damaging bot called “browser in the middle” that allows thieves to manipulate the data that a user sends to a bank. The bank may see six authorizations for payment when the user thinks she’s sending one. When the bank acknowledges the six authorizations, the browser intercepts and shows the user only one.

Hackers have discovered that small and medium-size businesses (SMBs) are far more vulnerable than major corporations. SMBs can’t afford the kinds of costly defenses the big guys can erect if they choose. The stakes are higher too. If someone hacks your personal bank account, you’ll be made whole. But courts in many states have ruled that if someone hacks a business account and the bank followed standard security protocols, the business is on the hook for the money.

Hackers haven’t forgotten about you either. While the Web has encouraged sharing via Facebook and LinkedIn, those networks have become portholes to problems. Friend the wrong person and go to that unknown friend’s recommended website, and you are asking for trouble, buddy. A Facebook bug called Koobface that takes over your account is infecting a million accounts daily, says IronKey’s Jevans. As for LinkedIn, he says, “I can make a very authentic-looking LinkedIn invite.”

Hackers are also using the data gamed from social-network sites to build credible individual identities with which they can infiltrate corporations and websites. Even if you don’t have a Facebook account, someone could create one for you — as happened to the head of Interpol.

The Counterattack
The good guys aren’t standing still, of course. The focus now is to disconnect a person’s e-mail and browser from the rest of the network with a variety of security layers. Companies are also figuring out new ways to protect themselves from employees who work at home beyond the corporate firewall and from the growing threats via mobile devices, including iPads and other tablet computers. Until then, corporations and government agencies are well advised to keep the doors locked, change the default settings and train employees to be on guard for spear phishing and social engineering.

We think in terms of Moore’s law — that computing speed doubles every 18 months. But “hackers are thinking in days,” says Entrust’s Conner. There are things you can do to help protect yourself: not just changing your passwords but also making them long enough and complex enough to be a meaningful deterrent. But at a more basic level, it’s about not oversharing with people you may or may not know and being a little more cautious even with people you think you know. It takes a little of the social out of social networks, but it’s safer.

“The main thing is that it’s going social. If you look at Lulz, would you believe a hacking group has a p.r. office, a Twitter account and a request line?” asks Jevans. “It’s crazy. It’s creating a whole new culture of people who feel they are entitled to do it.”

That’s sort of how LulzSec feels. It has prodded the public for its watching-the-train-wreck attitude toward hacking. But even LulzSec doesn’t know how long it can last. British officials recently arrested a hacker who may be part of the group. “We’ll continue creating things that are exciting and new until we’re brought to justice, which we might well be,” says LulzSec. “But you know, we just don’t give a living f— at this point. You’ll forget about us in three months’ time when there’s a new scandal to gawk at.”

At the rate the hackers are moving, it may be even sooner than that. It’s the damage that could be lasting.

Read the article at time.com

A better way to share large files is to use a great easy-to-use free service called Dropbox. Here’s how to do it:

1. Click this link and create your account
2. It will then prompt you to install Dropbox, go ahead and install it
3. You will now have a Dropbox folder on your computer which looks like any other folder. But it is a special folder because you can use it to share files with anyone else or to make your files available on any other computer

Once you have Dropbox installed, here’s how you can use it to send us files:

1. Open your Dropbox folder and make a new sub-folder inside it
2. Drag all the files you want to share into that folder
3. Right click on the new folder and from the Dropbox menu choose ‘Share this folder…’ (this will open a window in your web browser)
   
4. Enter the email address(es) of who you want to share it with and click the ‘Share folder’ button.
   

The rollout of Google Instant started Wednesday in the U.S. and will continue across different regions over the coming months. According to information on Google.com:

Google Instant is starting to roll-out to users on Google domains in the US, UK, France, Germany, Italy, Spain and Russia who use the following browsers: Chrome v5/6, Firefox v3, Safari v5 for Mac and Internet Explorer v8.

It is not yet officially available in New Zealand but if you have a Google account you can try it out if you are logged into your Google account. Just go to google.com and if it changes to google.co.nz scroll down to the bottom of the page and click on the link ‘Go to Google.com’. If you are on the iGoogle page, do an initial search to get to the search page. You will know that Instant is turned on if you see a little message to the right of the search box that says ‘Instant is on’. Just start typing and you should see the search results appear on the page as you type – that’s if it works. In my test it worked initially but then stopped working (the results on the page were no longer being refreshed as I typed). I got it working again by starting over in a new tab.

You can also check it out by watching Google’s promo video:

Google Instant may have ramifications for some websites visibility in searches. As people start to type they will see the results of multiple search queries flash before them and may find something of interest before they have completed what they were originally planning to type. A website that shows up at the top of the results for the full query may not show up on the partial query where the searcher jumped off. It appears to me it that this could have the effect of making shorter keywords more valuable in search engine optimisation.

Another impressive advancement in Google Instant is that it takes personal information into account in the search results, so it can potentially present a different set of search results to different people typing the exact same query. This sounds like it could make SEO more challenging. Some are even making bold claims that this innovation will bring about the end of SEO – Google Instant Makes SEO Irrelevant. But Google’s Matt Cutts in his thoughts on Google Instant assures us that SEO won’t die but acknowledges that it is likely to change:

The search results will remain the same for a query, but it’s possible that people will learn to search differently over time. For example, I was recently researching a congressperson. With Google Instant, it was more visible to me that this congressperson had proposed an energy plan, so I refined my search to learn more, and quickly found myself reading a post on the congressperson’s blog that had been on page 2 of the search results.

Google Insights for Search has been around since 2008  but is still in ‘beta’ mode (test mode) – check it out here.

Google is still the King of search and this deal is not expected to de-throne it, but by combining their market share the Microsoft/Yahoo combo will make a more compelling platform for advertiser’s dollars.

Since it’s unveiling in May, Bing has been fairly well received. Personally however, I have no plans to switch. After trying it out a few times, it left me unimpressed with the quality of the search results. Take for example a search for “Nelson web design” (a term I check occasionally to see how sww.co.nz is ranking in local searches). Here are the top 10 search results that Bing returns right now (NZ only search):

No. 1 is a valid result, but nos 2 & 3, both from the same domain, are not at all relevant results. In fact they are just temporary development pages on the nelson.co.nz domain of our partner, Digital Promotions, and the real Digital Promotions website appears much further down at position 10. The nelson.co.nz domain crops up again in position 6, another irrelevant result, indicating an overly heavy emphasis on domain name over content. I count only 6 relevant results in the all-important top 10. Not a very smart result for an allegedly ‘smart’ search engine (or ‘decision engine’ as Microsoft prefers to call it).

Here’s what Google returns for the same search:

Hey, that’s more like it – Stellar Web Works listed at a respectable 5th position (and even finds it’s way to no. 1 in the map results!). This time all ten results are relevant.

So, after this little test my faith in Bing is definitely a bit shaky. But with the recent Yahoo deal it looks like it is going to become part of the our web developer world and something we are going to have to work with from a SEO perspective. And if it gains traction, a bit of competition for the Google monster might not be a bad thing!

A list of web design companies in Nelson, New Zealand

Stellar Web Works

Your best choice for web site design and development in Nelson (yeah of course I’m biased;), but seriously, do give us a look if you’re after professional results at affordable prices)

Baby-e

One of our partners, Baby-e is the web design company of Leon Dalziel. Leon has a flair for design. We work together on many projects.

Digital Promotions

Another close partner of ours. Digital Promotions do a lot of accommodation web sites. We have worked together on a number of sites. They specialise in an Apple based content management system called Manila and provide hosting for it.

Bounce Marketing

Bounce Marketing, the company of Katrina Lambert is also a partner of ours. Although not exactly a web design company, it is a company that can help you promote your web site, drive traffic to it and get results from it.

Andy McCubbin

Freelance web designer/developer who I’ve collaborated on projects with.

Graphic Flavours

Web site design by Ayelet Fleming. I’ve worked with Ayelet on a number of projects.

DevelopMental

The company of Nelson based developer, Steve Bryant, specialising in website and windows application development.

SunRoom

The web team of Charlie & Melissa Evans along with Michaela Blackman. Friends of SWW. Specialising in sites and e-commerce solutions built on WordPress and Magento.

Lucid Design

Lucid Design is a graphic and web design company founded in 2000 by Galen King. Lucid Design moved it’s base from Golden Bay to Nelson in 2009.

Nimbus Advertising

Nelson based advertising agency headed by Dave Knight and Jo Williams and offering web design as one of their services. SWW has collaborated with Nimbus on one of their web projects.

Thadeus Creative

Web and graphic design by Steven Hussey. I’ve developed a site based on one of Steven’s designs.

Cactus Software

Web site design and development and custom software application development

Blueflowers web design

Web design company of Mariska Noordik & Mike Widdowson based in Rai Valley

Hothouse

A larger agency that do web design, marketing and branding

@ web one

Two web design businesses, Peter Lowish Internet and Internet Specialists, joined together to create this one.

Sprocket Web Design

Web design company of Duncan Heal

Avoca House Design

Web design company run by Brendyn Montgomery (who is also an award winning traditional Irish musician that you can catch playing on Wednesday nights in the Free House)

Site Productions

Web design company of Rick Coleman based in Mapua

Web Kiwi

Web design company of Adrienne Ford

Net Maestro

Web design company run by Gareth Lawes

Seafront Web Design

Web design company of Wendy Whitehead in Ruby Bay

Purple Oar Software

Web site design/development company of Paul Roper

Dry Crust Communications

A Richmond based publicity company that offers web design as one of their services

Fig Tree Design

Wendy Alessi’s web design company, Fig Tree, specialises in the design and development of gorgeous websites for small to medium sized businesses.

Website Revolution

Web design company of Maggie Sweetman, specialises in Flash websites.

Downing Design

Nelson based web design, graphic design and advertising, run by Tony Downing.

However, if you do not have any experience with getting a website set up and/or little or no technical knowledge of the workings of the internet, you’ll probably struggle with how to evaluate a web designer. The purpose of this article is to give you some ideas of what to look for in a web designer and to get you thinking about matching up a web designer with your own particular needs and requirements.

Questions to ask a web designer

• What technologies do you use to build websites? e.g. static HTML, HTML templating system such as Dreamweaver, Content Management System, server side scripting languages
• Will I be able to make updates to the website myself without any special technical knowledge?
• What is your process for designing and building a website?
• What is your approach to search engine optimisation (SEO)?
• Do you provide training for managing the new website?

Questions to ask yourself about a web designer

• Does the designer design sites that are intuitive and easy to use?
• Does the designer do a good job of visually showing visitors how to take action?
• Do they explain issues in a way I can understand?
• Does the designer have the range of skills needed to build the website that I require?
• What credentials and experience does the web designer have?

Comparing pricing from different designers

Does the price represent good value for my money? Keep in mind that a well designed website for your business is an investment that will pay for itself many times over in sales, while a poorly crafted site will drive away potential customers. A cheaply put together website may seem like a bargain at first but in the long run it may damage your business.

Price and quality often (but not always) have a direct relationship, i.e. you get what you pay for. Designers who are overly inexpensive often lack experience, don’t understand much about online marketing, or don’t truly have a grasp of good web design techniques. A website from such a designer may cost your business dearly in the long run.

When comparing quotations from different design firms, be sure to look carefully at what each designer is offering for the quoted price. Examine their portfolio to see what type of work they produce and ask to speak to some of their clients.

Consider too what happens after the website is built, who will maintain the site and keep it up to date and fresh? What type of analysis will be available for evaluating the performance of the site?

A poorly designed website can cost you money, drive away customers, and hurt your reputation.

Oh, and by the way, if you are looking for a creative, technically savvy, and cost-effective designer, check out Stellar Web Works!

Big business doesn’t have to care; the guy on the end of the phone still gets his pay check no matter what happens with your web site. It’s all about accountability. To a big business with lots of clients, you are just one more drop in the bucket. It’s not such a big deal to them if they loose you. But to a small business you are their bread and butter. A small business cannot afford to loose a client and needs to make each client happy in order gain new clients and have any chance of success.

A small business is far more likely to have a finger on the pulse of your web operations and react quickly to your needs, because its service is more personalized. A small business will know what’s happening, who it’s happening to, and what to do to fix it.