Finding The Culprit Of High Bandwidth Use

On Wednesday I was visiting my parents and Dad mentioned that over the last 2 months he'd been seeing some high bandwidth use on his home DSL. Typically in the past they'd never used more than 10-15GB/month because they don't use streaming video and the biggest bandwidth hog is probably uploading photos to Facebook. Lately it has had occasional days where the use has gone up to 5-7 GB in a day.

He had it narrowed down to one laptop because one of those days happened when they were not even home, but that laptop was still on.

Dad is a pretty techie guy, he worked for Honeywell computers out of college and then Bell Canada for a very long career specializing in large business PBX and 911 systems. He's never been afraid of computers. I think he'd rank highly on the MIT hacker test because he actually has programmed with punch cards.



Anyway, given that background this is what I've suggested to him:

Download and install Wireshark from http://www.wireshark.org/download.html
Once it is installed, open a CMD DOS prompt and change directory to C:\Program Files\Wireshark>

Run this command, and leave it running all day. It will record what servers on the internet (by IP addresses) you connected to and how much traffic was sent. This command also tells it to ignore traffic that is between two addresses that both start with 192.168...  thus ignoring anything that is local to your house.

tshark.exe -i Wi-Fi -z conv,ip,ip dst net 192.168 and src net not 192.168 or ip dst net not 192.168 and src net 192.168 > C:\users\public\tshark.txt

Note: you may need to change the "-i Wi-Fi" part to "-i Local Area Connection*" or something else.
Use "tshark -D" to find the list of network interfaces on your computer.

It should print "Capturing on 'Wi-Fi'" then a counter. Meanwhile in the file C:\users\public\tshark.txt it is recording what servers you connect to, if you use CTRL-C to stop it, or just close the CMD window, it will end the file with a chart of what connections it saw and how many bytes were transferred.

example output:
  3.708876 192.168.2.206 -> 65.54.81.79  TCP 74 [TCP Dup ACK 2393#21] 16378 > http [ACK] Seq=1 Ack=2076733 Win=1327 Len=0 SLE=2095609 SRE=2111581 SLE=2078185 SRE=2094157
  3.709305 192.168.2.206 -> 65.54.81.79  TCP 74 [TCP Dup ACK 2393#22] 16378 > http [ACK] Seq=1 Ack=2076733 Win=1327 Len=0 SLE=2095609 SRE=2113033 SLE=2078185 SRE=2094157
  3.710766 192.168.2.206 -> 65.54.81.79  TCP 54 16312 > http [ACK] Seq=1 Ack=1854205 Win=969 Len=0
  3.712005 192.168.2.206 -> 65.54.81.79  TCP 54 16312 > http [ACK] Seq=1 Ack=1857109 Win=964 Len=0
  3.712776 192.168.2.206 -> 65.54.81.79  TCP 74 [TCP Dup ACK 2393#23] 16378 > http [ACK] Seq=1 Ack=2076733 Win=1327 Len=0 SLE=2095609 SRE=2114485 SLE=2078185 SRE=2094157
================================================================================
IPv4 Conversations
Filter:ip
                                               |       <- -="" nbsp="">      | |     Total     |    Relative    |   Duration   |
                                               | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |      Start     |              |
192.168.2.206        <-> 65.54.81.79                0         0    2419    138406    2419    138406     0.000000000         3.7128
================================================================================


Edit: Included a screen capture because Blogger doesn't seem to have any fixed-width fonts.

Zombie Awareness Month

Today is the first day of Zombie Awareness month.

As such, I’d like to talk to you about the computer type of zombies.

You see, computers can become zombies quite easily if they are not properly cared for. Unlike humans, for whom there is no known zombie virus, there are a ton of nasty infections that can turn your computer (be it a PC, or a Mac) into a zombie.  Bad folks on the internet intent on using YOUR computer to make THEM money will set up websites designed to download just such an infection to your computers which will in turn allow the attacker to take over the mind of your computer, making it a zombie (sometimes also referred to as a bot).  These zombie computers link into something called a botnet and are then controlled by the zombie master (bot herder) who set up the site that infected them in the first place.

This nasty person bent on controlling your PC to his/her advantage may then send SPAM from it, use it to attack other computers or websites on the internet, run some money making scheme involving lots of processing (like bitcoin mining) from it, log your keystrokes and use what you type to learn your passwords to your bank and other places where the attacker could steal money from you.

The thing about computer zombies is that they have to talk to their master to learn what he/she wants them to do next. A good protection against that is a firewall that can alert you to new programs trying to make outbound connections. Most paid antivirus programs come with such a firewall, newer versions of Microsoft Windows even have one like that built in, and for older Windows computers that don’t, there is always the free ZoneAlarm or Comodo firewalls.

If your home computer asks you if it’s ok to let a new program connect to the internet, that’s what I am talking about. If you see it ask about letting a program you didn’t install make connections, just say no, run a virus scan and maybe a tool like Malwarebytes to search out the source of the infection. If you are not comfortable doing this on your own, seek help from a professional. Don’t let your zombie computer continue to use the internet, nothing good can come of that.

Firefox ProTip: Group your Tabs

One nice feature of Firefox that I thought unnecessary at first, but have recently grown to love, is tab grouping.

At first Firefox doesn't obviously have this feature, you kind of have to know about it to start using it. If you are lucky you might see the tab groups icon in the tab bar (at the for right next to the + for adding a new tab, it looks like this: ) but for most of us, we have to turn it on.

To turn on tab groups, right click in an empty area on the tab bar next to your last tab. For some of you finding an empty area in the tab bar might be a challenge, but it's worth it, trust me. in the right click context menu click on customize.That will bring up a menu full of icons to add to the toolbar, like this:





Find the tab groups icon in there and drag it to the tab toolbar.


Now you can start grouping tabs by clicking that button, which will bring up a window with icons for each of your tabs. Just drag a tab icon off the window into space and it will form a new tab group. Drag other similar tabs into that tab group, and optionally give it a name. You then just click a tab to go back to the normal view and you will find you are only presented with the tabs in that group. You will be able to switch between tab groups by clicking the Tab Group icon, or pressing CTRL-SHIFT-E and then selecting a tab from the group you want.

I use this routinely to keep tabs for some topic I'm researching together and separate from social media tabs that I might also want to have open, but don't need to have staring me in the face.When Somoene comes to my desk asking me for help on something, I create a new tab, quickly hit CTRL-SHIFT-E  and make a new group for it and I am ready to work on that problem and keep it's links seperate from everything else I'm working on. This helps prevent accidentally closing other things when that problem is resolved as I can just kill that tab group and move back to whatever I was working on before.

Give it a try. If you are a tab addict it is well worth trying.

Bitcoin - Getting Started

I'm sure you've been hearing all kinds of buzz lately about Bitcoin. And coincidentally, I recently put a bitcoin tipping QR code in the right hand menu on this blog.
The bitcoin to fiat currency charts (whether that be $ USD, $ CAD, £ GBP,  or € EU or whatever other currency you use where you are from) had an interesting rise and crash this past month that brought all kinds of attention from news agencies all over the world.



 With all this new attention on bitcoin I think that it's a good topic for this blog, as there are a lot of people just starting to look at it out of curiosity now wondering what it is, how it's used and whether it is something for them.

Bit coin is the first example of what is being called a cyrpto-currency. To keep this explanation simple, bitcoins are a digital virtual form of cash that is stored ina client program called a Wallet. Bitcoin uses a publicly available (as in every machine running a Bitcoin Wallet client has a copy) ledger in which all transactions are recorded. To prevent fraud or accidental double spending of the virtual coins, it uses very complex calculations to verify all transactions in the public ledger. The ledger itself is shared between Wallet clients over a peer to peer network similar to bit torrent, where all of the wallets share new pages of the ledger, called blocks, with each other. At the time of this writing, that ledger is currently about 8GB, and always growing. The official bitcoin client (bitcoin-qt) downloads the whole ledger starting from day 1 a block at a time and re-verifies it all. This can mean that setting up a new bitcoin wallet with a fresh install of this client can take hours, or days before it is synced up with the network and ready to use. There are, of course, ways to short-cut that process, but if one wants to be very careful and trusts no one else there could be a wait of several days to get set up in bitcoin.

To avoid the long delays you can set up an online wallet through a service like My Wallet by Blockchain, or WalletBit. Or if you have an account at Reddit Just send a message to /u/bitcointip and the tip bot on that site will set one up for you, and will even let you use your Karma points on that site to obtain a small amount of bitcoin currency to play around with. With online wallets they are available to use almost immediately, but you are trusting the site owners to protect your money for you.

So, you have some fiat currency (lets say it's $USD) and you want to convert that to bitcoins,  how do you go about doing that? Well, for the average user you set up an account at an exchange like Mt.Gox
or one of the other exchanges listed here: https://en.bitcoin.it/wiki/Trade#Currency_exchanges or, if you are lucky you might find someone willing to do an exchange in person (I hear Craig's List is a place you might look for that)

Once you have some bitcoin money in your wallet sending money is cheaper, easier and more reliable than PayPal. Unlike PayPal though, you cannot complain to a company to get your money back if a transaction goes south. In that way, it's more like cash. once it leaves your hands, you can't get it back through a charge back, you would have to get the police involved if you were scammed. On the flip side of this is that for a seller you don't have to worry about scammers posing as buyers then asking PayPal for their money back claiming that they never got what they paid for.

Where it also acts more like cash (and I think one reason why the client is called a wallet) Like a real life physical wallet, if you lose your bitcoin wallet your money is gone, unless you can find it again.
You can and should backup your wallet, and don't wander around with all of your money in the wallet on your cellphone, only carry what you plan to spend that day. You can have as many wallets as you want.

With a wallet on a mobile phone, transferring money is as simple as scanning the other person's QR code (AKA "3D" barcode) and clicking send.

The nice advantage of bitcoin is that it has low (or even no) transaction fees and you can send an amount that is worth only a fraction of a cent. This enables micropayments in much smaller amounts than PayPal or anyother service has ever been able to do. This can be good for small fundraising efforts on the internet.

Dreamhost.com My New Favorite Web Hosting Company

Ok, so many years ago (10+) I first bought my own domain name, and for the first little while I hopped around from hosting ISP to hosting ISP, and finally settled on Media Temple about 8 years ago and stuck with them all that time mostly out of inertia.

Recently (around xmas time) I decided it was time to start shopping around for a better host. One that had cPanel (which is the industry standard control panel these days) and maybe offered better rates or more space, or more database instances.... then around January I noticed a limitation in Media Temple's MySQL setup. Namely I could grant access to my databases to any IP I wanted to use a management tool from, but there could only be 10 addresses at any given time granted access, and those same 10 addresses had access to ALL my databases. This doesn't seem like much of a limitation to most folks, but I had a database I wanted to set up that would be accessed directly by desktop applications being run from my home and a couple of friends' homes, all of which are on dynamic IPs and I didn't want to be constantly adjusting that approved IP list. So I quickly started hunting for a new host.

Along comes Dreamhost, with unlimited bandwidth and unlimited disk space (actually just a high amount of each that is ever increasing, kind of like the disk space limit in Gmail), and unlimited number of domains hosted, unlimited MySQL instances, that each can be managed individually from their own list of approved addresses (including wildcards) and unlimited user accounts so each domain or database could be managed from a different user account if I wanted.

Add to all of that Google Authenticator based 2 factor authentication on the Cpanel interface, and easy checkbox config for domain level Google Analytics so you don't have to drop Javascript into all your pages. Plus the ability to use Ruby and Django (Python) for some of my sites.

They have one click installs of all kinds of popular web software like mediawiki, Wordpress, Joomla, Moodle, phpBB, OpenVBX, ZenCart, and more!

On top of all that, the security guy in my has to remind you 2-factor auth!!! and encrypted FTP, E-mail and web based FTP.  Yes, IronGeek, Adrian Crenshaw also uses Dreamhost.

All of that and it was 1/2 the price I was paying for MediaTemple. They gave a free trial to start off so I could get set up on their servers and play around until I was familiar enough with it to commit with money paid.

If you decide you want to switch to DreamHost use this promo code and you'll save $10 off a 1 or 2 year pre-paid account. RODSAVEDME10

Secunia Launches Cloud Based Patch Management For SMB

For all my Small Business friends:

Secunia, one of the big names in Patch Management (software that makes sure your computer is up to date) has just launched a cloud based service for small businesses with fewer than 50 PCs.

Secuina Personal Software Inspector (PSI) has always been free, but only for personal use. (and I highly recommend everyone install it as one of those must have bits of free software)
Corporate Software Inspector (CSI), thier main product line, has always been just out of reach for a lot of small businesses both from a price point and because it requires you to install and maintain a server for it. They recognized this limitation and put together this new Small Business solution.

Read about it here: http://www.net-security.org/secworld.php?id=14476
Sign up for the free trial here: http://secunia.com/products/smb/smallbusiness/

After the beta ends the first 5 machines will still be free and additional machines less than $5/month each.

I have been a user of PSI on my home computers for years and couldn't be happier. Now with this I have something to recommend that can protect small business machines as well.

The Blackberry Z10 is a nice phone that runs the new Blackberry 10 OS.

I have had one for a few days, and there are 2 downsides I see with it. #1 terrible battery life compared to older blackberries. (the best I have achieved so far is 17 hours with Wifi and Bluetooth both on)

#2 is the lack of Apps. My old BlackBerry had Kindle, RSA SecurID, and Google Authenticator. None of these are available for my new BB10 phone.

They are available on Android though, and Blackberry 10 kind of, sort of supports Android software. What you need to do to load android software is somehow get your hands on a .bar file of it and sideload from your PC.

You would use DDPB on your PC to sideload apps.
Sideloading can only put the app in the personal side of the BB10 device.

Instructions on how to do that are here in this video from GoodEReader.com:

Once you have that program installed on your PC you can download already tested .bar files from GoodEReader.com

If you can't find the files you want you can get the .apk from any android device by installing airdroid on the android phone/tablet and connecting to it's webpage from a PC This will let you download the apps that are installed on the android device.
Once you have the .apk file you can convert it to a .bar file here.

I have converted the Google Authenticator for Gmail 2 factor authentication. The converted .bar version does not scan the QR code like it does on Android, but that's OK with me, I had to type the key code into the one on the old blackberry too. 

Internet Down :(

Right now my internet is down.

Yes, I'm blogging and my internet is down. And the sad news is because it's a phone company problem it'll probably be down for days.

My DSL modem dropped off the internet at about 6PM EST. This also means my home phone is down because I have it set up as a Voice Over IP connection. That, as you can tell, didn't keep me off the internet. Not even for a heartbeat.  As I determined that the trouble was the DSL line. (the outside line, beyond the DSL modem in my basement) I grabbed my cell phone and looked up their number in the built-in web browser, and called my ISP. As I waited on hold I switched it to the Facebook app to tell my friends that our planned movie night was off as I had no Netflix if I had no internet. Truth is I already knew how I could set up Netflix, and I may at some point this weekend if we're really bored, but it would not have be very enjoyable at the time with the on-hold music playing over the phone.

Having sent the message to my friends I continued to wait on hold, with the cell phone plugged into a charger to keep it from dying before I got through to a live body. Once I did get through to Mark at Tech Savvy (Thanks for taking me seriously Mark, the first person I spoke to wasn't willing to help me until I turned the computer off and on again. Seriously, that was what she asked me to do, and refused to help me because I insisted that the computer was not the problem as I could clearly see that the modem's DSL interface did not have sync... I didn't catch her name, did you guys hire Jen from IT Crowd?) ...anyway, once I got through to Mark and explained the situation, stepped through some troubleshooting of connecting a phone to the dry loop only to hear a bunch of static. (sounds like water in the line, it is raining out. I'm guessing a squirrel chewed the drop) We then plugged the modem into the demarcation jack outside (in the rain at night, but it proves a point to the phone company that will come to fix it... that the trouble isn't in the 6 feet of indoor wiring between the outside wall and the modem.

Once the busy work of setting up a work order for a Bell tech to come out was done, I sat down and my wife was chatting online via the "experimental" browser in her Kindle. I proceeded to plug the Blackberry back into the USB port of my laptop to charge and launched the BB Desktop to connect to the internet. Anna asked if she could borrow my computer, I asked "Why? I'll just share my internet with you." A couple of clicks later, and we were both sitting comfortably on the couch with our laptops, surfing the internet as usual.

It's amazing the connected lives we live these days. I kind of anticipated this sort of development when I was in high-school suffering from BBS withdrawal on a week-long camping trip in Algonquin Provincial Park. I could see a day coming when I'd probably always be connected. Well, at some point that just happened.

[Edit: 2:25 PM 13/01/2013 :
Bell guy came and switched us to another pair, one of the wire in our pair on te drop was broken. Damned squirrels!]

Ubuntu Phone

Years ago I imagined a time when I would have a PDA/Phone size devices I could carry in my pocket, but when i was at home I could dock it and it would be my desktop computer.
That device has finally arrived.

While Android and iPhone battle it out over which will claim the hordes of users fleeing the sinking ship of RIM BlackBerry, and Microsoft struggles to claim chunk of the market for themselves, a new player enters the game. It is Ubuntu Linux, and the phone is a full featured Linux machine. Connect it to a docking station at home and it is your Desktop, or your media centre, or whatever you want it to be. It is a truly portable computer.

Wake on LAN

Ever wished you could click a button and a computer in another room would boot itself up? Maybe you want to stream your iTunes media from a computer in the bedroom to the media center HTPC in the living room, but you didn't turn the bedroom computer on when you were last upstairs. Maybe you want computers to wake up in the middle of the night so they can get that 3am scheduled update... Maybe you manage a whole network of computers and there are a few that just don't get used often and you want to boot them up so you can check on them over the network. This is what Wake on LAN (WOL) is made to do. Any computer that is Advanced Configuration Power Interface (ACPI) compliant can be turned on remotely. You might have to go into the BIOS/UEFI firmware to set the WOL option to enabled, but it should be there. In the old days (around 1999) they used to sell PCI add-on network cards that had a Wake-on-LAN cable, a little twisted pair of wires that ran from the LAN card to the motherboard to send a wake-up signal. These days the wire is no longer needed (heck the card is no longer needed) WOL has become so common-place that it's just built-in.

Some home routers have WOL software built into them to wake the computers on your home network. Some corporate patch management software lets you WOL machines as needed.

Linux has a command line program called wakeonlan.
It is used  by typing:
wakeonlan [-i IP_address] [-p port] [hardware_address]

Windows has this too, called wolcmd (well, sort of, you have to download it from the 3rd party website www.depicus.com)
It is used by typing:
wolcmd [mac address] [ip address] [subnet mask] [port number]

Either of these can be put into a script to do more complex things like scheduling.

You can get WOL on your phone from Depicus too, and wake up your computers right from the palm of your hand. For iPhone/iPad/iPod Touch, Android and even Windows Phone! He also has a little GUI version, but because it doesn't remember details, it's less useful than the command line version, but it's not as scary to some users.


Personally, I wanted an easy way in windows to create groups of computers that wake up at a given scheduled time, so I've thrown together a little program over the holidays that I can use to wake PCs up on a schedule.
My program is called OgounWOL and you can download it here. (requires free registration to use)

OgounWOL comes in 2 parts. A little program that you can schedule to run once every 15 minutes, and a GUI manager (shown below) that you use to edit the program's database.

In OgounWOL you first create a list of all of your computers, then group the computers into groups that you want to wake up together, and then set up schedules to wake groups of computers up at a given time.
You don't need to keep this manager open, every 15 minutes the scheduled task will run a program silently in the background to look up if anyone needs waking and if so, send them the WOL Magic Packet to wake them up.

I have another version, that runs from a command line and takes a .csv file listing computers that you want to wake up. I call this one WOLCSV It is free and does not require registration. I wrote that one for use at work back in 2011.

Microsoft EMET

Over the holidays some of you may have seen some version of this story:
http://thenextweb.com/microsoft/2012/12/29/criminals-use-adobe-flash-and-new-ie-vulnerability-in-targeted-attacks-ie9-and-ie10-users-are-safe/

or if you are a security geek, this one:
https://community.rapid7.com/community/metasploit/blog/2012/12/29/microsoft-internet-explorer-0-day-marks-the-end-of-2012

Once again, a new 0-day Internet Explorer vulnerability was discovered that affects IE7 and IE8. On the 29th an exploit for it was introduced into Metasploit, and you know they say, crimeware advances at the pace of Metasploit. (Metasploit is open source, so any programmer can see exactly what they did to expolit the bug and copy that if they have not already figured it out for themselves.)

You may note that aside from upgrading to IE9/IE10 there is a suggestion that you could mitigate this vulnerability by running EMET. The only realistic action for many businesses to take would be EMET.

This is not the first time you might have seen this suggestion, but most people I have talked to who are not well read on IT security have never even heard of EMET.

The tl;dr executive summary is:
EMET stops malicious programs running in the context of legitimate programs by killing the whole process before the malicious code can do it’s damage. This allows us to protect against some unpatched vulnerability exploits. It is free and MS supports it.


What does EMET do?
EMET (Enhanced Mitigation Experience Toolkit, I think that’s a rather poor name, so I will always refer to it as EMET) is a free program from Microsoft (fully supported by MS) that allows you to specify various security mitigations that are built into Windows, but not often implemented in software.

DEP, ASLR, and SEHOP can be turned on at a system level (although they are not by default)
DEP, SEHOP, NULL Page, Heap Spray, Mandatory ASLR, EAF, and Bottom-up ASLR protections can be turned on for individual applications. (see manual for more info)

DEP is already mandatory on 64bit Windows for all 64 bit processes, but not for 32bit programs. All of the rest are optional, and often not implemented by software developers even if there is no reason they need to avoid them. EMET allows you to turn these abilities on even for programs that were not designed for them. (Caution, some of these may break things for some programs, but they are easy to switch on and off)


EMET has 3 lists of defaults that can be set for applications. These defaults have already been tested by engineers at Microsoft. They can be set by importing one of the 3 default lists that come with it, or via GPO (more details below)

SANS's New Monthly Awareness Video Page

Securing The Human is a corporate security awareness training program based around a bundle of 2-6 minute computer animated videos that each highlight an aspect of computer security. The full corporate training program costs $3000 or more per year (unless you are in the government or education sectors), and includes tracking employee views to allow for completion certificates to be e-mailed out and to give managers a log of employee completion of the training so that you can use that for compliance purposes. It also allows custom content such as policy documents to be attached to the training materials.

The good news for really small organisations that cannot afford even the $3000 small business package (which allows you to have upto 750 seats) is that they now offer one video per month for free, but obviously you'd have to track who watched it yourselves. Maybe you could hold a monthly staff meeting and review the video together. Better yet, this allows private individuals who are not employed by a company that subscribes to the Securing the Human program to have access to the materials at home.

Secure Browser Settings

I know this is going to be long and technical, but it is important for everyone regardless of your technical ability to look at.
The one line TLDR version (TLDR is internet speak for "too long, didn't read") is this:
Secure sites use SSL. TLS is the newer SSL. You should be using the newest one you can.

Ok, so for a while now webmasters, IT people, developers etc, have been slowly transitioning the internet away from SSL 2.0 to newer versions of the protocol. SSL is the s in https:// it is the secure part of secure websites. Version 1 was phased out before most folks even knew there was an internet, but version 2.0 has stuck with us, despite being broken in many different ways, for a long time.  The payment card industry, via their PCI-DSS rules by which individual merchants have to run their payment networks, and banking systems have to communicate with merchants across data networks like the internet, has outlawed the use of SSL 2.0. A while back. And so, most websites and some browsers (I think all browsers except Internet Explorer) have abandoned the old clunker of a security protocol. By default most newer web browsers support SSL 3.0 and TLS 1.0 (which can be thought of as SSL 3.1 or 4.0).

TLS 1.0 was first introduced back in 1999. In 2002 a theoretical exploit was discovered. About a year ago that exploit, dubbed the BEAST (Browser Exploit Against SSL and TLS) was made easy to do. It allows a person who can insert themselves between the user's browser and the secured web server to pick and choose what bits of encrypted data get sent and use the chosen length bits of ciphered text to get a head start on decrypting the conversation. This is effective only against SSL 3.0 and TLS 1.0, and only when they use block ciphers like AES and 3DES not stream ciphers like RC4. Because they have decided that we've had enough time, the payment card industry is starting to insist that merchants protect against the BEAST attack. This can cause someone with inadequate security settings on their browser to get a blank page when trying to connect to a secure website.

So far TLS 1.1 and 1.2 are still quite secure, but not used everywhere yet and not supported by every browser.

I'm going to show you how to turn on the best protocol available to you in the most popular browsers and then if you are also a techie running a server, I'll go into how to do the server side.

First Internet Explorer:


For Internet Explorer:  In internet options, under the advanced tab, scroll almost all the way to the bottom and you will find these settings.
By default SSL 2.0, SSL 3.0 and TLS 1.0 should be on, I am recommending that all users switch off SSL 2.0 as no sites on the internet rely on that anymore, and it is a very broken protocol.
Also,  if available (if you have Windows 7 or higher) you should turn on TLS 1.1 and TLS 1.2 as well.


Now Firefox:



Firefox  already should have only SSL 3.0 and TLS 1.0 enabled. If it does not have TLS 1.0 checked please make sure you enable it.
Again, TLS 1.0 dates back to 1999 there has been over a decade of use ensuring that all sites and browsers are compatible.
The only reason to have it turned off is if you are US Government and required to use only 1.1 and 1.2  :)  but as we can see with the Firefox example, not having anything older than 1.1 means breaking compatibility.

On the server side...

IIS:

IIS uses the Microsoft SChannel settings. The protocol versions it supports are turned on in the registry. Paste the following code into a file called saferSSL.reg or something like that. then double click on your new .reg file to import those settings.
Windows Registry Editor Version 5.00 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56] 
"Enabled"=dword:00000000 
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server] 
"Enabled"=dword:00000000


And optionally (this one will break compatibility with IE6):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] 
"Enabled"=dword:00000000


And then to enable TLS 1.1 and 1.2:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1] 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\client] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2] 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\client] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
 
Then go into the group policy editor (type gpedit.msc into the run box or command line)
Find the section: Local Computer Policy -> Administrative Templates -> Network -> SSL Configuration Settings
edit the Cipher Order value to include only RC4 ciphers for SSL 3.0 and TLS 1.0.
Move "TLS_RSA_WITH_RC4_128_SHA" to the top of the priority list, and get rid of any SSL 3.0 or TLS 1.0 ciphersuites with CBC in the name. You can keep whatever TLS 1.1 or 1.2 ciphers you need (hint anything with SHA256 or higher is fine). If you are not sure what to include just copy this string into that box and click OK.

IIS 7.5:

TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,SSL_CK_RC4_128_WITH_MD5,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521

IIS 7.0:

TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,SSL_CK_RC4_128_WITH_MD5


Apache:
Put this into your config

SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH