The power of notoriety

Heartbleed and you

Just after I posted my item on The Second Factor (1), I saw a syndicated story under the heading of “Double-layer passwords offer additional protection online.” It started out “If the Heartbleed security threat teaches us anything, it’s that passwords don’t offer total protection.” (2)

While that was a good article on why and how multi-factor authentication is valuable, its reference to Heartbleed was as valid a lead as a picture of a scantily-clad model.

Don’t get me wrong. Both topics are important considerations for your security online. But I haven’t seen any clear lay explanation as to the risk and impact of Heartbleed on the ordinary user.

First the technical details. Heartbleed was a flaw in OpenSSL, a component of certain webservers, from 2012 until April 9, 2014. Depending on whom you listen to, this flaw could have affected between 66% and 17% of all websites on the internet. I’m inclined to lean toward the lower number.(*) But this is still serious since the count is of sites, which included the likes of Google and Yahoo.

Due to the high risk from the flaw, OpenSSL team had issued a patch within 72 hours of being notified and less time from any broad awareness. Most of the larger secure sites implemented the patch immediately. In fact, I first became aware of the flaw when I started getting notices from my banks that they either were never vulnerable, or had already patched their system.

What does Heartbleed do? The flaw allows a hacker to induce the server to send him the contents of a small portion (64 kilobytes) of its memory (remember that a webserver will have 8-64 gigabytes of memory). The affected memory would contain random bits of the server’s recent activity.

This memory could be the contents of its own webpages which anyone could view. It could be the computer language instructions to manage the website. It could also be bits of the conversation between your browser and the server that establishes your secure connection in advance of telling your bank to pay a bill.

All the hacker has to do is get the same server to send him a few thousand 64 KB downloads. Then he has to scan through the mostly binary data for the flecks of gold that are recognizable. Once found, he has to refine those flecks into real knowledge that he can exploit for value. (If that sounds tedious, all of the tasks can be automated.)

What is the risk to you? It’s possible those flecks of gold may include your account name and password. But if the hacker’s goal is passwords, that’s an inefficient way to get them. Every week credentials are being stolen in million-account lots through other security lapses and flaws.

A far more valuable nugget to look for is the webserver’s master key to all its SSL/TLS communications. If a hacker has this, he can create a fake website that your browser will accept as authentic. Then he can execute a perfect phishing or man-in-the-middle attack against any visitor to his bogus site. He can also decrypt previous “secure” traffic to most sites. Of course, the latter two attacks require the hacker either be in the middle or have access to previously recorded internet traffic.

What should you do? Unfortunately, because of how the flaw works, there is no way to know that a specific site has, or has not, been hacked. If your partner has advised you that they have eliminated any risk from this flaw, you should change your password for that site. Take this opportunity to use a strong and unique password for each of your high value web accounts. If available, you might enable 2-factor sign-on to reduce the possibility of an account being hijacked.

Once a site has been patched, they should have received a new SSL certificate and revoked their old, compromised certificate. Unfortunately, as of this writing, there is no reliable way to ensure you know that you aren’t accepting a stolen certificate. Some browsers, maybe with some deep settings, will warn you that a certificate has been revoked. There is one site that will test whether your browser properly recognizes a revoked certificate. There is one known website that can actually serve you a revoked certificate. If you go to http://revoked.grc.com(3), you should receive an error. If your browsers test good and give you the error, you can read more about revocation at(4).

There’s more at risk than just websites. Although I have not seen an authoritative list, SSL is by far the dominant method of protecting electronic communication on the internet. Potentially vulnerable services run the gamut from a sophisticated private VPN to the heavily consumer cloud storage services. They could also include the likes of email, chat and VoIP, or routers for both home use and controlling the internet.

Unfortunately, many of these services are either embedded deeply into the technology or are never managed again after the original configuration. They will be patched slowly or not at all.

Fortunately, as the variety of programs for exploit increases, the number of clients shrinks. If the host in a peer-to-peer network serving two nodes is invaded, it could be devastating for those two, but will not affect anyone else.

Like the number of potentially vulnerable webservers, many of these services are not at risk from Heartbleed because their communications are not encrypted in the first place. Your chat, email, and cloud backups have been coursing through the internet as plain text; easily readable by anyone with a tap on the line – and I don’t mean just governments.

Bill Barnes with Dewey Williams, PCCC

----------
Notes
(*) The reported risk to 66% of all websites refers to the number of websites that are running webservers that might use OpenSSL. These are primarily the programs Apache and nginx.
This number has to be reduced by the large number of websites that don’t even offer SSL. Again subtract the number what did not install the affected versions of OpenSSL and you get a much lower percentage of the Web. However, with worldwide web sites numbering in the 9 digits (decimal); whether the affected percentage is 30% or 10%, it’s still a huge number. (5)

References
(1) Blog post “The Second Factor”. http://fromthehelpdesk.blogspot.com/2014/04/the-second-factor.html
(2) AP article “Double-layer passwords …” read in The Charlotte Observer. http://www.charlotteobserver.com/2014/04/26/4865676/tech-tips-double-layer-passwords.html#storylink=cpy
(3) Test website for a revoked certificate. http://revoked.grc.com
(4) Explanation of revoked certificates. https://www.grc.com/revocation.htm (also on podcasts referenced below)
(5) The number of websites truly at risk. http://news.netcraft.com/archives/2014/04/08/half-a-million-widely-trusted-websites-vulnerable-to-heartbleed-bug.html.
More references
An early announcement on Heartbleed. http://pc3.org/heartbleed-bug-affects-60-of-secure-internet-servers/
Text and podcasts on Heartbleed. https://grc.com/sn

. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(cc) 2014- Bill Barnes - Disclaimer - Home Page - Blogs Home

The Second Factor

The Second Factor

Sometimes when creating or logging into an online account the system will ask for a phone number or a second email address. Recently my users are asking me “why do they want that?” One user ignored the request so many times the system locked her out of a portion of her account until she provided it.

This alternate point of contact is called a second factor authentication and is a means for the website to verify that you are the person who signed up for the account. It is similar to your bank asking for the last digits of your Social Security Number or the doctor’s office wanting your date of birth. These are bits of information that they know came from you and should be different from anyone else who might share your name or other primary login.

This is not the same as when a website shows you a picture of the Statue of Liberty or a Corvette after you’ve logged in. With that the website is proving its identity to you because an imposter would not know which picture you are expecting. Second factor authentication allows you to prove you are you to the website.

If the website offers second factor, it’s a good thing. Imagine if someone were looking over your shoulder and stole your password. Then they could login as you and change your settings such that you are no longer getting notifications from the site. If it were a shopping site with a memorized credit card, you might not know what they are buying until you get the bill.

Typically the second factor will send you a one-time code that you must enter before proceeding. Check your email, type 4-6 digits or click a link, and you’re in. Often it will set a cookie in your browser and not inconvenience you even that much every time.

Ideally, the second factor should be delivered out of band – that is, through a different network than you used for your first factor. An excellent option is to send you the code for a website by cell text or voice telephone. If instead of looking over your shoulder, someone stole your computer, he might have access to your email as well as the website.

Second factor is more reliable than asking how many sisters you have or which high school you went to. Someone who’s gone to the trouble of stealing your identity could also find out that information. Instead it relies on responding with unique real-time information delivered to a device you would likely not lose at the same time as losing your computer.

If you provided the second factor channel (such as your cell phone number) at the time that you created the account, there is no way it could be hijacked. You’re well on your way to accomplishing the triumvirate of identity: something you know, something you have, something you are. That is: your logon and password (both something you know), your cell phone or a dongle (something you have), and your biometrics (like a fingerprint reader).


. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
    (cc) 2014 Bill Barnes - Disclaimer - Home Page - Blogs Home

If you really want to keep your Windows XP

These tips are in no particular order. Note that some tips may require also following other tips that might come after or before them.

• Always log on as a Limited User unless you absolutely must update some software.
  Lack of administrator rights blocked over 90% of the Windows OS* malware in 2013.
• Keep all your software and applications up to date. Make a list of programs that need regular updates and check for updates at least monthly.
• Don’t use Internet Explorer; install the latest versions of Opera, Chrome, or Firefox.
• Install and use the NoScript and Ghostery plugins for Firefox.
• Uninstall JAVA. At least, disable it in all browsers.
• Uninstall or restrict use of Adobe products. A recommended alternate PDF reader is Sumatra (I have not used it). Use the built-in readers in Chrome or Firefox instead of a plugin. 
• If downloading an Office document, preview it in a viewer instead of the full program. Disable any macros.
• Uninstall Microsoft Security Essentials and use a 3rd party antivirus such as the free options from Avast, AVG and others.
• Upgrade to Microsoft Office 2007 or newer. Better still, move to a non-Microsoft suite.
• Upgrade to Internet Explorer 8 (the highest level that works with XP).
• Don’t access the internet (including email) from your XP computer. Don’t install unknown software downloaded from the internet by other computers.
• If you must browse the web, restrict the ability of malware to get to you:
  
  • Ensure you are behind a router – the first-line firewall – and that Windows firewall is active.
  • Configure your email reader to display only text – no pictures or links.
  • Use Firefox with NoScript. Learn the controls in NoScript and don’t casually allow everything.
  • Browse only to sites you are familiar with.
• If you must use email on XP, restrict the ability of malware to get to you:
  
  • Use webmail. In particular, gMail online is practically immune to transmitting malware to your system.
  • Use a mail client other than Outlook or Outlook Express.
  • Configure your mail client to display messages as “text only.”
  • Do not open email attachments or follow links until you have independently verified with the sender they are benign. Read our article on evaluating an email.
• Shut your computer off when not using it.
  You may discover you have very little need for XP. Plus, older computers are less efficient and you’ll save on your energy bill. 

* Logging on as a Limited User will block most malware that attacks flaws in and installs to the Windows operating system. This does not include malware that attacks flaws in individual programs such as JAVA, email, Microsoft Office, or .pdf documents.

Additional References
Some of these references are documents and must be downloaded and viewed in their program. Yes, they're safe for XP.
PC Club of Charlotte’s original presentation
http://pc3.org/smfpc3/index.php/topic,266.0.html and
http://zaitech.com/articles/misc/download_documents/TheEndOfXP.docm

Security researcher Steve Gibson’s comments:
https://www.grc.com/sn/sn-447-notes.pdf (first page) and
http://twit.tv/show/security-now/447.
                 
. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2014 Bill Barnes - Disclaimer - Home Page - Blogs Home

Ctrl-Shift-P – your new best friend

Do you flip among reading webmail, social networking, gossip sites, research, and shopping or banking in the same browser? Do you realize that browsing history, search details, and even some logon information could leak from site-to-site?

Google – and, not to pick on just them, many other providers – encourages you to sign in to your account “for a fuller browsing experience” as soon as you open your browser. What they’re really wanting is to establish a relationship – ie: a cookie – with you so they can follow what you’re doing and suggest (sponsored) alternatives to your current choice. This tracking capability is not hidden, nefarious, or necessarily malicious. It’s designed into the Web and browsers as well as your user agreement, and can only be thwarted with obscure configurations in each browser’s profile.

I used to alleviate my concerns over this leakage by ensuring I closed all my browser sessions and reopened the browser before doing any financial transactions. One time I was trying to sign in to a major shopping site with a different profile than I usually used. No matter which of my usual tricks I used, it still insisted on pulling up my personal profile. Obviously they were tracking me with multiple cookies from multiple domains and I would have had to completely clear my history from that browser to get a fresh login. My only alternate option was to use a company computer from which no one had ever signed into that site.

Most modern browsers now offer some form of “private” or “incognito” browsing. A private session is a pristine instance of the browser with no history, no cookies, no remembered passwords. When you close the private instance of the browser (the entire window and all child windows – not just logging off the signin), it deletes all record of that session so the details can’t be tracked across other websites. The next time you open a private instance, you’re starting over again.

When private browsing was first introduced it closed or locked out your “regular” instances of that browser so you couldn’t do anything else while in it. Now it functions just like another browser window that you can switch back and forth between. Identify your private session by the notation in the title bar.

Caveats:

A private browser instance only protects you against successive session browser tracking, persistent cookies, and cross-site leakage. It doesn’t stop the web server from fingerprinting(1) your computer or any malware already installed on your computer or the server. All the cookies and history already in your system are still available to the browser – it just makes all cookies you get now “session” cookies. And, if you browse to any other sites in the same private instance, you might as well have used a default instance.

Private browsing is not a sandbox you can use with abandon; just a slight improvement over the wide open web. For better protection against tracking and leakage you need to use a pristine “computer” by booting to a live CD or a clean virtual machine. This works whether doing your banking or surfing to questionable websites – just be sure you reboot in between.

A private browser session is available from the main menu of most browsers. In Firefox and Internet Explorer, you can use the hotkey Ctrl-Shift-P. Chrome and Opera use Ctrl-Shift-N.

(1)      http://Panopticlick.eff.org

. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2013 Bill Barnes - Disclaimer - Home Page - Blogs Home

Microsoft abandons retail market

If you don’t follow technology at a certain level, you may have missed the news: Microsoft has told the consumer market to kiss off. That’s not exactly how they said it, but we know that old adage about actions and words.

First they took a page out of the cable TV industry and obfuscated their business pricing such that it is impossible to compare products and pricing. In fact, there is a certification just to support Microsoft licensing and most businesses that don’t shop at Best Buy hire a consultant to advise and manage their relationship. Then they introduced an all online version of their flagship product (yes, Office makes more money than Windows). The revolutionary (meaning Google’s only been doing it for half-a-decade) online and installable Office 365 is subscription only and starts at $9.99 per month. Forever.

That takes care of soaking or eliminating people who just want to write a letter. What about the people who make it possible for small business to run efficiently and economically?

Recently they announced that they are eliminating the primary program most people who support their products but don’t wear a Microsoft shirt use. TechNet is a subscription that gives one or more copies of just about every product that anyone who doesn’t have thousands of users across multiple sites could need – “for evaluation purposes only, not for use in production environments.” Depending on the promotion du jour, I gladly paid $150-$350 per year for the privilege to use 5% of what they offered me. Unfortunately, too many people were getting TechNet and sharing or selling the individual license keys.

My primary business is supporting people who use 1-10 computers. They don’t make their money with their computer; but do have to use their computer to make money. When your client consists of an accountant and her receptionist/account manager/billing clerk; you get calls to do everything from buying a printer cable to establishing a new office. This includes setting up and optimizing their email, preparing a customized mailing, or converting the contents of their client’s database to simplified spreadsheet.

Those tasks require Outlook, Word, Excel, and possibly more Office programs. I feel no guilt using my TechNet versions of these applications because I am supporting an office that paid the highest price for their own copies. I’ll tell you a secret, Microsoft. I could also complete these tasks using apps from Google or Open Office. Those cost me and my client – nothing. More significantly, they earn you nothing.

Microsoft; for every IT professional who gives you thousands of dollars a year to keep a certificate on their wall, there’s 5 or 10 or dozens more who support and promote your retail products. You just turned them into Google and Linux salespeople. Retail may not be the goose that lays golden eggs, but it is a cash cow that gives good milk year-after-year. When the time comes that all your money is from enterprise, it’s HP and Dell that tells them what to buy. Remember, they also sell tablets and laptops as well as management services. If you continue encroaching on their hardware and support businesses; they too may become Linux salespeople.

. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2013 Bill Barnes - Disclaimer - Home Page - Blogs Home
 

Some people don't count

Always check your coverage - ideally with a real device on the network - before you choose a cell carrier.

How fast is your internet?

Both of these connections came from the speed test at http://www.speakeasy.net/speedtest/.

 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Are you sure you want to buy Windows 8 as soon as it comes out?

I've been using a dedicated retail computer as a file server since I discovered network file sharing some 20 years ago. For over half that time I've done the same for my clients (businesses with less than 10 - usually 1-3 - users).

The primary server need for a small business is file sharing. Everyone sees all the same files (depending on access restrictions) in the same drive letter and folder. There's no concern for versioning when documents are emailed around the office. Most critically for the sysadmin, backup is centralized.

No, you don't get local Exchange, some server-installed apps, or automatic workstation imaging. You do get reliable and versatile data storage and hugely simplified administration. And migrating your data to a new server is a matter of copying one folder, configuring users, and repointing shares.

If you think I’m just an old curmudgeon advocating this for everyone, here’s someone else who agrees. Here’s a good article on establishing a small network file server.
http://windowssecrets.com/top-story/a-cheap-effective-home-server-using-windows-8/

Convinced? Now the pull-back. If you think the Win8 features fit you to a “T”, you may want to wait until next summer. This post raises with good warning the point that we should never rush critical services to a new environment.
http://windowssecrets.com/forums/showthread.php/149213-A-cheap-effective-home-server-%E2%80%94-using-Windows-8?p=870808&viewfull=1#post870808

No phishing

Did that email really come from my bank, or is it just a good imitation? Phishing is a message that purports to come from one source, but actually comes from a bad guy; usually trying to steal your valuable personal information.

Last month we discussed ways to recognize whether an email was probably legitimate. Here is an example of a good email I received from one of my financial institutions.

First of all, notice that I have disabled automatically showing pictures in email I receive (green circle). The critical content of the message is completely contained in text. Pictures can hide links or silently allow the sender to track that you actually opened the email and might be susceptible to more like this. Sloppy phishers may also use pictures wholesale to copy the look of the legitimate mailer rather than recreating the text from scratch.

Secondly, there are only two places (red circles) where they give you the specifics to contact them: one is a phone number and the other an email address. Neither of these contact points asks directly for your personal information.

As a reminder of good practices, the central part of the message advises you to type their website into your browser - no links to hide a bad connection - and log on to your account.

A few other financial institutions use similar good practices to send you critical information. Others - credit cards are notoriously bad - wrap their status updates around a myriad of pictures and links. Some of these links may not even go back to the sender, but to advertisers or other third parties. That type of email may be acceptable for a newsletter, but don't ever log in to your account from a link in a congested email.

Read more
Windows Secrets article on "Whether Windows is safe for banking"

And then, there's a bad email from a financial company:

 

 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2012 Bill Barnes - Disclaimer - Home Page - Blogs Home

The internet will die tomorrow!

Panic!
The internet will die tomorrow! (Monday July 9, 2012)

Maybe. But not likely for you. For 0.02%(1) (that’s 1 in 5,000) users in the world. Only 27%(2) of the total are in the US and since the US has a high percentage of users; your chances are even lower.

What happened?

A few years ago some bad guys infected some users and changed their DNS settings. The DNS system tells your internet connections where to go when you type an address such as “google.com” in your browser. Rather than using the master DNS servers, an infected computer gets its directions from the bad guys’ servers. When you typed “google.com” (or any normal address), they would actually send you to Google. However, when Google sent your browser back to pick up an ad, they would insert the destination to their own ads so they made money.

Pretty soon the global police forces found the bad guys and took over their system. But they realized if they shut it down cold no one who was infected would get to Google when they typed “google.com.” So … our FBI has, for several years, paid a private company to run the bad guys’ servers and to serve up correct information.

Why will the internet die?

Now the FBI has stopped paying this bill and 250,000 computers won’t be able to find Google, or any other named domain, until they fix their settings.

Am I infected?

Probably not. See the first paragraph above.

A site that will give you a quick “yes” or “no” is at www.dns-ok.us, but with some caveats. The FBI also has a 6-page .pdf(3) explaining how to check your own DNS settings. It’s tedious, but detailed enough that anyone reading this can follow. It also points out that your computer can have an apparent safe setting while your router is infected.

References

(1) – Article on Time Techland.
The best non-tech explanation I saw.
http://techland.time.com/2012/07/06/dnschanger-no-the-internet-isnt-shutting-down-on-monday/

(2) – Infection count by country, as of 6/11/12

http://www.dcwg.org/top-dns-changer-infections-by-country/  
Spreadsheet of percent by country
http://bit.ly/PC3-DNSchanger

(3) – The FBI post
http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf

 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Should I open this email?

Should I open this email?

A client asks:
I received an email from someone I don’t recognize. The email had an attachment (document) he wanted me to evaluate. Do I dare open the attachment?  Is there any way I can do so and guarantee it is not a virus? 

Basically, no. You can’t guarantee it’s benign.

In this sort of circumstance, either as sender or recipient, I try to validate the legitimacy of the contact. In the text of the email I identify myself and the attachment by filename and size. Sometimes I will make non-email contact to alert the recipient or verify the sender. Unless you or the data on your system are particularly high value, it’s unlikely a random attack would take the effort to pass these tests.

If you can’t make this “out of band” contact and still want to open the message or its attachment, there are some unilateral assessments you should make first. Start with the anti-spam / anti-phishing / anti-virus triggers you apply to every subject line, message, and attachment.
In the preview, before you open the email:
•    Are you expecting this?
•    Do the From and To addresses look reasonable. For example, do names look random or made up, are there multiple similar addressees at the same domain, or is your exact address missing from the list? If it makes reference to an account, especially a financial account, and is not directly and exclusively addressed to you; it’s probably a phishing attack.
•    Is the subject line meaningful and relevant?
•    If it refers to an “issue with your account;” does it identify the account or describe the problem?
•    Does the content apply to you? (Immediately trash a notice from BigBank if you don’t do business with them.)
•    Do the grammar, writing style, and content ring true to the request? If it comes from someone you know, do the style and content match what they usually send?
•    Are there excessive links and do they connect to what you expect? Hover your mouse over the link and look at the entire URL. Work back from the first “/” after “http://.” A link of “http://BigBank.com.BadGuys.ru/...” will actually take you to BadGuys’ site. While you’re looking at the links, pay attention to the top level domain (TLD). That is the letters left of the “/” until you hit a period – classically “.com” or “.org.” The “.ru” in the example above refers to Russia; along with China, a common starting point for malware. This is a minor indicator as bad guys can buy a .com and good things can come from unexpected countries such as bit.ly (a useful URL-shrinking service), where the “.ly” stands for Libya. (http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains#Country_code_top-level_domains)
•    Are the attachment’s name and file type what they appear to be? It’s an old trick to name the attachment “CuteKitty.jpg” and then pad the name out with many spaces before giving the actual functional name of “…virus.exe” which falls off the edge of the page.
•    Is it delivered primarily as pictures? Your previewer should be set not to download pictures automatically, but only on your request. Downloading the pictures can deliver malware and return significant tracking information about you. If you can’t comprehend the gist of the message from the text it doesn’t deserve further analysis.
•    Look at the source of the message. In Microsoft Office (retail) Outlook, right-click on the message and choose View Source. This is very geeky and includes a lot of garbage; but, with experience, you may be able to spot something suspicious. Backtracking the internet headers is even more obscure, but can reveal that the sender is not who he appears to be.
•    Did it pass your up-to-date virus and spam checker? Antivirus programs often remove the malware attachments and deliver a message that contains very little text. There’s usually a good reason for it to be labeled spam.
•    Right-click the attachment and save it to a temporary folder on your computer or sacrificial thumb drive. Run an on-demand virus check on it.
•    Be sure all your viewing software is up-to-date. There is often a “check for updates” option under the Help or Tools menu or you can go to the publisher’s website. Especially visit adobe.com, java.com, and microsoft.com at least monthly to check for updates for Adobe Reader, Flash Player (hopefully, you’ve never installed Shockwave Player), Java, and Windows.
•    Open the attachment in less common programs. For example, use foxit (www.foxitsoftware.com) for .PDFs rather than Adobe Reader or send office documents to Google Documents (docs.google.com).
•    Open the attachment on a Linux or Apple computer as malware is often (but not necessarily) Windows-specific. You can get a CD to boot your PC directly into Linux. Everything runs in memory and when you reboot there’s no record (and hopefully, no residual evil) from what you just did.
•    If this were a legitimate email and you trashed it without opening would it really cause any problems?

Surf - and email - safe!

Read more:
An example of a "good" email from your bank. 


 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Tech Talk - Shared Folders

An enterprise user wants to transfer multiple files to a colleague at another site within the company. Previously I created a folder on our shared drive and told him anything he put there, she could get with a link I gave her. Fast forward a couple months and he asks what that link is, again.

You can map a drive letter on your computer and have it point to a folder on your computer or another computer on your network. That is convenient if you want to easily access a folder deep in your file system or on another computer. But the drive letter is an artificial designation. Your S: drive could be someone else's T: drive. How do you tell them exactly where to find a file?

Here's a step-by-step explanation of where a mapped drive is:

• A mapped drive is a shortcut to a folder on some computer on a network (it could even be your computer).
• Because everyone may map their letters to different locations you need to tell them the absolute location (this is called the UNC – for Universal Naming Convention – location).
• The UNC includes the server name and the share name of the shared folder. The share name may be different from its true name when viewed from the computer it resides on.
• If you look at My Computer, it tells you what folder is mapped to the drive letter; for example: shared on server (S:) (exact format may vary by version of Windows.)
• The first thing before the server name is two backslashes (\\). Each folder is separated by a single backslash. Starting with “\\” tells many programs (such as Outlook) to make this a clickable link.
• Therefore, S:\IT\Temp becomes \\server\shared\IT\Temp. This is called the complete path to the file.
• Note that if there are any spaces or unusual characters anywhere in the path, the entire path must be enclosed in quotes. This is why I am so anal about my naming conventions because even the people who know this often forget it.
  It’s even harder making links to a file accessed through a browser. Don’t even try. If you’re linking to an http: resource rather than a network file, sometimes the browser address bar will replace special characters with their code such as %20 or %2d.
• This only works if you are both on the same or linked networks. You can’t send a link to someone outside the company or your home and have them find a file on your computer or server.

 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Google … evil?

According to a recent story, federal investigators are revisiting the question of whether Google Street View did anything wrong when they captured individuals’ WiFi data in the process of taking pictures the view along every inch of the worlds’ roads and streets.

To refresh, Google drives around in funny looking cars with posts sticking out of the roof. On these posts are cameras looking in every direction taking pictures of what you’d see if you were driving down this street. When you’re looking at Google Maps, click on the little guy above the scale slider. These cars also collected data on all the WiFi routers they could detect from the street. Their mobile GPS service can triangulate off these radio signals to give you a more accurate location, just like your cell phone company can find you from which towers are picking you up. In the process of fingerprinting WiFi signals, they also “inadvertently” recorded the data that was being broadcast.

If they scanned through the petabytes of data they might have collected, would they find anything interesting about you? Probably not. Did they steal your banking password? Definitely not. Was this illegal? In my opinion, not under US law. Is Google evil? That’s a point of opinion.

Technical discussion

How does it work?

A WiFi router can be identified by its name and radio channel. You have to verify this information when you go to a friend’s house so you use his internet and not a neighbor’s. By accurately knowing the car’s location, and monitoring the signal’s strength as it moves, Google can get a good feel for where your router is located. Since in most neighborhoods you can detect signals from several to many routers it’s easy to determine where you are; even if it’s not strong enough to get online.

What did they record?

Allegedly, in the process of collecting identifying details, they also recorded everything that was in the air as they went by. The cars are driving down the public street, not doing anything to intentionally invade anyone’s privacy. What they got was snippets of electronic conversations, just as if you were to cruise through a cocktail party in Tokyo.

Would they find anything interesting about you?

Firstly, you’re only picking up a couple sentences from any one in particular so you may hear them asking for another drink or even just stuttering a couple words – nothing malicious there. Plus, most people are speaking a foreign language – just like most WiFi connections are encrypted with their security password.

Did they steal your banking password?

Even more secure than your protected WiFi signal, not only financial sites; but every reputable site uses SSL (https) at least for password protected signs. Services like gMail, Twitter, or Facebook also are or can be accessed through secure SSL.

Was this illegal?

For the life of the wireless industry the rule has been that any signal accessible on the public airwaves is fair game. As long as they don’t try to invade your computer or decrypt or make fraudulent use of what they hear, listening in and recording it is not illegal. Think of the decades of big satellite dishes along rural highways just grabbing the networks’ unscrambled feeds or the celebrities whose cordless (not cell) calls got exposed.

Is Google evil?

Maybe, but not for this misdemeanor. I am much more concerned that my ISP might throttle my internet just because I’m a heavy user. Or that Hollywood is trying to get a fishing license to track down and prosecute anyone for a single, possibly illicit, song or video. Or that the NSA is analyzing a yottabyte (1,000 times the entre global internet traffic for a year) in a $2 billion bunker in Utah.

Let’s give Google a pass this time. And take it as a reminder to be sure your WiFi connection is protected with WPA and a good password.



 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Block that cookie - more than you want to know

Please come back soon for more details.




 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Block that cookie

Note: The tips that follow reference one or all of Firefox, Google Chrome (Chrome), or Microsoft Internet Explorer (IE). Other browsers probably have similar features; but when I say “all,” I’m referring to all of these three. Examples come from recent versions of the browsers: Firefox 11, Chrome 18, and IE 8.

The good news is that you should be able to ameliorate a lot of the techniques to track you that web sites use. Much internet tracking is based on good old-fashioned web (html)  cookies. It’s easy to block cookies. Unfortunately, being followed by cookies is also vital to much of the productivity of the internet. They allow sites to remember who you are as you move from page-to-page; for example, from Add to cart to Continue shopping and back. They come in 2 basic flavors: first party and third party. (To find out about first and third parties, read our next post.) First party cookies are good to OK; but you might think twice about third party.

The easiest and most powerful way to protect yourself from tracking is by using a private browsing session. (instructions: next post). In this case, nothing, about your session stays on your computer when you close the browser. You can’t come back to a search or be automatically logged in at any site. You should always use private browsing on a computer you don’t control.

If that is too aggressive, your browser can control what it does with cookies. With greater or lesser ease (instructions: next post), you can usually tell the browser to block all cookies or only third party cookies. You can also accept cookies but tell your browser to throw them away at the end of the session. This gives you the advantages of using cookies; but websites won’t know about you the next time you go there. FireFox also allows you to choose your action for every cookie you’re given. This gets tedious fast, but is revealing as to how pervasive cookies are.

Another option is to choose a browser that you never sign to a site or fill out a form. Use another browser for your shopping, Gmail, or social networks. Financial transactions ideally should be transacted only in a private session. Although you trust your financial institution; you may be logged in, either temporarily or permanently, to another site which might benignly or maliciously have a small chance of tracking you there.

Unrelated to cookies; if you follow a link to a site, it knows where you came from and, if a search engine, what the search terms were. So if you got here by searching “Block that cookie” on Bing; Blogspot (a Google service) knows that. Although this form of tracking is relatively benign and primarily used by a site to fine tune its own advertising, you can avoid it by not clicking the link, but type it into another browser.

On the other hand, there are ways that your computer may be tracked that don’t rely on html cookies or a specific browser.



 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Are You Following Me?

Did you read Google’s new privacy policy as of March 1? Nope, neither did I.

The primary piece of news is that Google is now consolidating tracking information from all of their services. This means you have the same login, profile, and preferences for Gmail, Google Apps, YouTube, and more. That’s not scary – since before Google was a college project; AOL and Microsoft, among many other services, have had a single login so your mail and instant messenger shared contact lists.

What is scary is that Google can consolidate your information across sites that you don’t log in to explicitly or sites you don’t realize are part of the Google family. For example, if you read a blog about the Parthenon on Blogspot and search for information on passports; the next time you check your mail you may see ads for Mediterranean cruises.

This is because one web service can track you across multiple websites. Since ads on many websites may come from the same ad server, you can be tracked even if the address you enter is a completely unrelated to any other place you’ve been.

Many web services pay close attention to where you came from, what you do, and where you go to build a profile of you. The more they know about you, the more valuable you are to advertisers and the more they can charge. (They’re not necessarily identifying you as a person by name and credit card number, but you as a 45-55-year-old male in a large southern city with 2 kids in college and an income over $80,000.)

However, if you’ve been logged in to a site that tracks you – such as Google – then they can tie your information to a real person with a name, address, credit card number, and possibly other details you’ve given them or their partners. They may not use all that information, but it makes your ads – and search results – more focused. (It may also make your search results less diverse. If you have previously selected the Washington Post, you may never again see a result from Fox News.)

I’m not picking on Google exclusively. Google just happens to be the biggest target today. I am less concerned being tracked by Google than I might be by a lot of other services.


The good news is that you should be able to ameliorate a lot of the techniques to track you that web sites use. Keep reading here:

But if you really want to be scared about tracking, your smartphone itself and many of the apps you’ve installed may be able to track you – not on the web, but in real life. And at the moment, there may be no way to control that tracking while still taking advantage of the reasons you got a smartphone.


 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Malware scanner

Worms and trojans and viruses – Oh my! But beware the insidious rootkit, my child, because it is . If you get a rootkit, it burrows deep into your system and disappears. Only a program specially designed to look for it will find it.

Microsoft has recently introduced the Microsoft Standalone System Sweeper (MSSS) that will, among other things, find and kill those pesky rootkits. Get the program at http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline.

MSSS is used a little differently than other one-time scans you’re familiar with such as MalwareBytes. It creates it’s own bootable CD or USB drive and you run it outside of Windows. It does this so it can find rootkits which, by definition, are hidden when Windows is running. If you actually bought your antivirus program on CD, it probably can do this; except MSSS is a little different (at least since I last had an AV CD). It doesn’t offer, but requires, that you update your definitions before running a scan.

Go to the download page and choose whether you want 32-bit or 64-bit. This button runs a downloader that gives you the option to create a bootable CD, bootable USB thumb drive, or download an ISO (Fig. 1). I’ll tell you what to do with an ISO next month; but until then, save yourself a lot of trouble and choose one of the other options.

Fig. 1. The MSSS downloader menu (this image may have changed).

I decided to try MSSS out on my file server. When it runs a full scan – the default your first time – it alerts you the scan could take hours. Sure enough, after 4:52:42, it reported the number of “resources scanned” was 3,520,572!

Admittedly, my single C: drive runs about 350 GB (there’s a lot of client files I really should throw away). The program looked inside compressed files, naturally. It also looked inside downloaded .ISO CD images. To my surprise, it looked inside some Outlook .PST files to find a virus in the attachment of a piece of spam.


This work by Bill Barnes is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.
Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.

Book Review

Review - Zero Day

Sex. Murder. Corrupt, bumbling bureaucrats. The Russian Mafia. The fate of the Western world. Hunky nerds and beautiful geeks.

Zero Day by Mark Russinovich has them all. It also has worms and viruses and rootkits – but you don’t have to know any more about them than that if your computer has them, it’s going to be a pain. This book is a can’t-put-it-down thriller until you start thinking about it. Then it will give you nightmares.

Zero Day starts with a company that is having computer problems. They call in a specialist who discovers that their servers have been infected with a particularly pernicious piece of malware. While he’s trying to get the company back in business a call from a colleague at the Department of Homeland Security lets them realize they both are vexed by someone known as “Super Phreak.” Could this be the harbinger of cyberwar? And one with an auspicious starting date.

Mark Russinovich is a Microsoft Technical Fellow. That is a position for a person who is so accomplished that he has no assignment beyond thinking up new ideas. Computer professionals will recognize him as the creator of the Sysinternals utilities. With names like LDMDump and PsGetSid, these programs allow you to learn things about your computer that you didn’t know existed; including that you have an infection down where your antivirus can’t get it.

Here, in Russinovich’s first novel, he uses his knowledge of what is and what could be to weave a story of what we hope never happens. Without referencing any specific real-life situations (see “Stuxnet”[1]), this is a story one could imagine was pieced together from page 4 of the daily newspaper. An airliner has a rough ride over the Atlantic. A ship runs aground in Japan. A hospital has a medication mixup. A worker dies in an industrial accident. Are these unconnected stories? Only our heroes have the insight to know that they are linked by Super Phreak’s zero day rootkit (you only need to know that’s a computer nasty no one has ever seen before). Since a political appointee is too inept, corrupt, or both to sound the alarm; our heroes have to chase, against the clock, across two continents on their own to save the world.

The first edition I had was marred by some editing errors. (The first chapter opens “Saturday, August 11” and on the next page in bold it refers to “Friday, August 11.” [This was corrected in the online excerpt.] In a faux pas as bad as calling your spouse with your lover’s name; another place refers to the heroine with a villain’s name.)

That said, the story maintains its credulity: travel takes real time, coincidences are fortuitous but not magical, heroes are strong and clever but not supermen. Worst of all, the technology is very real and is installed in any business or is available to any teenage hacker anywhere in the world where the internet is available. The story implies a single set of malware could damage a multitude of systems which, in fact, would have to be programmed individually. However, any of the attacks mentioned could happen any time in the near future – or be happening now.

If you like international political thrillers or if you like technology; you’ll like Zero Day. A pair of PhDs become unexpected agents sufficiently focused on what needs to be done to brush off an assassin’s bullets and to convince an uninvolved Russian to assist them in the course of a taxi ride. Russinovich has set himself up to have created the next Jack Ryan. Let’s hope we can look forward to more cybercrises to befall us. [Zero Day the book has no familial or topical relation to the 2003 or 2007 movies with a similar title.]
------- 

REFERENCES:

The book's homepage
http://www.zerodaythebook.com/
Mark Russinovich
http://en.wikipedia.org/wiki/Mark_Russinovich
Stuxnet
http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html
http://en.wikipedia.org/wiki/Stuxnet
Thanks to my source: Steve Gibson
http://twitter.com/sggrc
http://www.grc.com/securitynow.htm
. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Malware Alert !

Ransomware. It’s not a new form of malware (ie: viruses, trojans, worms, phishing, spyware, even spam), but neither has it faded into the background over time. Many of my clients needed my assistance after encountering it sometime during 2010. It first came to my attention 3-4 years ago in the form of “AntiVirus 2008.”

The vector is that, after visiting an infected website, a notice pops up on your screen that there is “a problem with your computer.” The “problem” it refers to may be a virus infection, update due, or disc defrag needed. The popup could vary from a poor imitation of a Windows information box to a dead ringer for the Windows Update shield and dialog or a Microsoft Security Essentials notice. Typically it uses spyware tricks to reload even after you’ve left the website or rebooted the computer. Usual Windows close window buttons in or on the window are often ineffective and you can only get it off your screen by right-clicking its icon on the taskbar. The window advises “click here” to resolve the problem – but beware! – clicking anywhere in the window could run the program. Then you’re in trouble!

You asked the website to install a program. It doesn’t need a rootkit or worm to run the malware. You asked it to install. Check out a full discussion of the process at http://windowssecrets.com/top-story/lizamoon-infection-a-blow-by-blow-account/.

Once the ransomware is installed, it locks up your computer only allowing you to go to their website to undo the damage. Of course, the “repair program” costs $20-$150. If you don’t shell out, it may have already encrypted your hard drive or it may corrupt your data before you can stop it.

Luckily, most of my clients contacted me and did not actually install the program. While they couldn’t get rid of the popup, I could log on as an unaffected administrator and squash it with a System Restore and multiple malware scans from different sources such as antivirus vendors, Malwarebytes, and Microsoft Malicious Software Removal Tool. Between alert refusal to install the program, antivirus scans, storing data on a server – not an active client computer – and backups; only one home user lost significant data. Everyone lost significant time and incurred the expense of my services.

. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Telephones over the internet

I get requests for suggestions on technical topics. A client was wanting to dump her home phoneline from the old-time provider. Here are some ideas of what she can do. The premise is that she has reliable and cost-effective cell service.

As you know, there are dozens of options to connect broadband internet and phones. If you want to ditch the phone company, here are some services I use and recommend.

Google Voice (http://voice.google.com/).
They give you a number and you can direct that number to ring one or more of your registered phones. You can apply rules including time-of-day filtering such as family goes to Sis, business to Mom, friends can be screened before picking up, unknown callers go to voicemail, etc. Receive voicemail as an email attachment or transcribed to txt. Documentation is Google-sparse.
Basic service free but lots of penny and nickel features available. No computer needed.

Skype (http://skype.com/)
Primarily a computer-to-computer service but you can buy connections in and/or out of the classical phone system. They sell tons of accessories including handsets so you’re not tethered to the computer. With decent broadband, excellent quality service – radio stations use them. Some are stant-alone and, presumably, give you a Skype connection anywhere you can get open WiFi.
Basic service free but lots of penny and nickel features available.

Vonage (http://vonage.com/)
This is the service I’ve used for 7 years, but am currently a little down on. I can’t document whether my service issues are related to Vonage or my ISP. They try to be a full function phone company replacement that you plug directly into your current house phone wiring and use all your classical equipment. They have some call management features similar to Google.
Our “$17.99” plan bills out about $25. No computer needed.

Here are some other services that I know about, but have never used.

Your ISP
All the internet providers (include the phone companies) are trying to sell you phone services. They offer the reliability you’re used to from a single source for prices you’re used to paying.

Magic Jack (http://magicjack.com/)
This is sort of a hybrid of Skype and Vonage. Plug an adapter into your computer and plug your house wiring into the adapter. Last I looked at it, they seemed a little sleazy in terms of pushing ads at you, etc.
Always-on computer required.

Packet 8 (http://www.8x8.com/)
I’ve never looked at them, but a (cheap) associate dumped his Skype dial-in/out for them. At first glance, they seem to sell full-featured phone systems to home or small businesses.

Being based in 21st century technology rather than 19th, all these services provide for free the upgrades the phone company has been making their profits off of for 30 years. Things like voicemail, voicemail notification, caller ID, conference calling, free long distance, ultra-cheap international calls, and more. Except for Vonage, most of them don’t add all the extra charges at the bottom of your classic phone bill.

Most of the services can transfer your current phone number. I always recommend letting them assign you a number until you’ve tried them for a couple months. Then you can transfer the number you’ve had for 25 years.

The downside is that, except for your ISP, they’re all separate services that you have to buy, install, and configure yourself. As far as I know, only Vonage and your ISP support 911. Support and reliability may be iffy and they are dependent on getting power out of the wall.



. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2010 Bill Barnes - Disclaimer - Home Page - Blogs Home