The Espionage

Introduction

Spyshakers.com Ghostpad is now available!  All relevant Ghostpad information will appear in this post.

The Spyshakers.com team has been researching spyware for well over 7 years.  Ghostpad is a product of that research.  Ghostpad is a javascript graphical keyboard that diffuses spyware on a password box (or a text box if you choose).  Any website that supports javascript can implement.  A demonstration can be seen on our Ghostpad Youtube Video.  You can also play with Ghostpad on our Ghostpad Demo Page.

Why implement Ghostpad?  Because some of your customers have a lot to lose.  Some of your customers are the targets of identity theft wherever they go.  Your website is always available.  Anti-spyware is not always available.  Your website can BE the anti-spyware.

The Ghostpad Script

Ghostpad is composed of (1) license called license.txt (1) javascript file called keyboard.js and (1) css file called keyboard.css.  Download these and save them in a directory of your choice on your web server.

• http://www.spyshakers.com/ghostpad/license.txt
• http://www.spyshakers.com/ghostpad/keyboard.js
• http://www.spyshakers.com/ghostpad/keyboard.css

Set up (Step 1)

The first step to use Ghostpad is to include the keyboard.js file and the keyboard.css file in your web page code. Your path to these files may be different depending on where you saved keyboard.js and keyboard.css on your web server.

<script type=”text/javascript” src=”keyboard.js” charset=”UTF-8″></script>
<link rel=”stylesheet” type=”text/css” href=”keyboard.css”>

The Password Box (Step 2)

If your password box does not have a class associated with it yet, this is going to be really easy.  Simply add the property class=”keyboardInput” to the properties of your password box.

 <input id=”pw_box” type=”password” class=”keyboardInput”>

Your done.  Save and view web page.  Ghostpad should function properly.

Does your password box already have a class associated with it in code?  Not a problem.  Examine the id of your password box (or assign the password box an id if it does not have one).  Now simply add css code to the new keyboard.css file to style the password box correctly.  For example, our password box has an id of pw_box.  We could just add this css to the end of the keyboard.css file to style the password box properly.

#pw_box{whatever css you want; you can probably just paste the css from your old class;}

That should do it!  Save and refresh your web page.  Ghostpad should now be working properly.  Ghostpad is free to test.   There is a fee for verification.  Verification allows us to keep track of who is implementing Ghostpad.  There is a verify link on each instance of Ghostpad.  Think of this as your Ghostpad “certificate of authenticity”.  It also works as a nice anti-phishing feature as well.  The cost for verification is only $199 per year.  Check and money order are accepted at this time (U.S. dollars).  Digital payment options will be coming soon.  When you are ready to verify simply email us at staff@spyshakers.com with the subject “Ready to Verify Ghostpad”.  We will then email you a short form to fill out and email back.

You are free to edit the colors to the Ghostpad icon or the background of the Ghostpad keyboard for use on your website.  Here are the images:

See the Ghostpad review on Security Tube here.

Your website can be spyware proof in one day.  Email us with any questions or concerns at staff@spyshakers.com subject “Ghostpad Question”.  Thank you for your interest in Spyshakers Ghostpad!

Share It!

 As I mentioned in my previous post (Securing Your Web Hosting Account) the File Transfer Protocol (FTP) is not secure by itself.  FTP usernames and passwords are transmitted in clear text.  That means that your FTP username and password can be monitored and stolen over the internet.  There are some exceptions.  If you are underneath a virtual private network (VPN) then your credentials are encrypted by the VPN.  Regardless, it is a good idea to use Secure FTP (SFTP) to upload and download your files when possible.  In this post I’m going to show you how to set up WinSCP securely.

It must be noted that not all web hosts offer secure ftp capabilities.  Your web hosting account must enable SSH access.  Three web hosts that provide SSH access are Midphase, Host Monster and Host Gator.

WinSCP

WinSCP is an outstanding SFTP Client (for windows) that can be downloaded for free at http://www.winscp.com/.  Download WinSCP and then launch the application.  You will see a button labeled “New” when you launch WinSCP.  Click on that button to set up a new secure ftp connection.  Here is a screenshot of the new connection screen:

A typical host name is something like ftp.yourwebsite.com. If your ip is dedicated to your domain name then you can simply enter the ip address as the host name.  The most important selections in this screenshot are the port and the protocol.   The port should be set to 22 and the protocol should be set to SFTP.  Save the connection.  Select the connection and attempt to login.  WinSCP will ask you to generate a key the first time you login.  If you are successful you will authenticate and see the files on your web server appear.  You can now drag and drop files from your computer to the web server (and vice versa) securely!

Notepad++

WinSCP will help you upload and download your files securely.  But what about editing those files?  There is a free editor for windows that can make writing your scripts much easier.  You can download it at http://notepad-plus.sourceforge.net/uk/about.php.  Notepad++ has a plethora of options that normal Notepad does not support such as syntax highlighting, auto completion, and more.

WinSCP and Notepad++ 

You can use Notepad++ in collaboration with WinSCP.  This way when you edit files in Notepad++ they will save out to your web server securely via the WinSCP application.  I will show you how to set this up.

Launch WinSCP.  On the left you will see a link to “Preferences”.  Click on it.  In the middle of the screen you will see a button labeled “Preferences”.  Click on it.  On the left you will see a link to “Editors”.  Click on it.  Find the button that says “Add”.  Click on it.  Choose the “External Editor” radio button and then browse for the Notepad++ executable file.  Save and exit.

Now whenever you launch WinSCP you can right-click on files on your web server and choose “Edit”.  The file will launch in Notepad++ automatically.  When you save your changes, WinSCP will update the file on your web server securely.  Try it!

Share It!