Why Hosting On YouTube Could Be Hazardous To Your Company's PR

A picture speaks 1000 words.

I was watching the video on the Netflix blog about the new Windows 8 app and guess what came up as a suggested next video...

...a kid explaining how to bypass netflix regional lock settings and watch USA netflix in other countries. Doh! social media fail for Netflix!

Windows 8 - Can I run it?

So Windows 8 is out, and you are wondering if you should upgrade.
Well, let's start with can your computer handle it?

You need to have these specs as a minimum.

• 1024x768 monitor (yes, it will run on as low as 800x600, but you won't like the experience as all of the new apps need at least 1024x768)
• 1366×768 resolution if you want the snapping feature
• 1 GHz (with PAE, NX and SSE2 support) sure, most people have that, but some might not.
• 1GB RAM (2GB if using the 64 bit version)
• DirectX 9 capable video card
• 20GB of Hard disk space 

This is a little more than Windows 7, so not every Win7 machine can be upgraded.

Now there is the whole start menu issue. Windows 8 doesn't have one, at least not in the traditional sense. It just throws all of the start menu icons onto a Start Screen that looks very much like a tablet screen and doesn't bother to sort them into folders. This can be annoying.

Realistically, Win 8's interface is designed to be used with a touch screen, so yes, it can be used with a mouse and keyboard, but you will find that you use the keyboard far more often now if you choose to use it this way.  You can't click the start button for instance, because there is no onscreen start button, you use the keyboard or a touch gesture to get to the start screen from the desktop.


Be prepared for some programs to not work in Windows 8. Just like any major Windows release, not all of your old software will work with the new OS. But, sometimes that is a blessing in disguise. I wanted to download MS Security Essentials for a Win 8 box I have, but found that there is no version for 8. That's because they re-named it Windows Defender and included it by default. Go MS! Finally you have done that right.

If you are a techie and want to run it in a Virtual machine first, (If you are a techie why has it taken till now for you to get around to installing it??) you should know it cannot run on Microsoft Virtual PC, Windows Virtual PC, Microsoft Virtual Server or VMware Workstation v7.x or earlier. It should run ok on newer VM environments though.

To check if your PC meets all of the requirements, you can run the Upgrade Assistant from Microsoft.

If you are looking for the cheapest way to get it you can Download Pro for $39.99 directly from Microsoft. Then you just burn your own DVD-ROM of it just like Microsoft's corporate customers have been doing for ages, and away you go.

PHPMyAdmin Distributed By One Mirror Site With A Backdoor Installed

To any web developer who recently set up a new server or upgraded phpMyAdmin on an existing server:

If you downloaded phpMyAdmin-3.5.2.2-all-languages.zip  from SourceForge between Sept 22, 2012 and Sept 25, 2012 you should disable it on any serrver running it and re-download it. One official mirror site based in Korea served a copy of this file that had been tampered with and had a backdoor installed.

Read more here: http://sourceforge.net/blog/phpmyadmin-back-door

Sophos False Positive for Shh/Updater-B

I have been talking about Sophos a lot lately, so I feel kind of responsible if someone started using it because of me and woke up this morning to a startling "outbreak" of Shh/Updater-B.

This is a false positive that accidentally disabled the Sophos updater. It somehow made it past Sophos QA and caused a lot of people headaches last night.

The IDE that is responsible is agen-xuv.ide

This is a quick little script that stops the Sophos Antivirus service, deletes that IDE and restarts the service. You can run this on the update servers and any workstations that give you problems afterward via PStools.

net stop savservice

if %PROCESSOR_ARCHITECTURE%==x86 (
  rem 32 bit
del "c:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide"
) else (
  rem 64 bit
del "c:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide"
)

net start savservice

After running this Acknowledge alerts in the Enterprise console.
I hope this helps a few of you.

If you need to empty quarantines on individual machines try this, but be careful not to empty a quarantine that contains a real virus, this releases the lock on quarantined files if you are using the recommended setting of deny access instead of move or delete.

net stop savservice
del "%ALLUSERSPROFILE%\Sophos\Sophos Anti-Virus\Config\Quarantine.xml"
net start savservice

Thanks to The folks at Sophos who published this last night and tweeted it out to the world.  http://nakedsecurity.sophos.com/2012/09/19/sshupdater-b-fsophos-anti-virus-products/

Sophos Mac Antivirus Home Edition

Did you know that while Sophos doesn't have a home edition of their PC antivirus they do have a FREE home edition for Mac?

It supports OSX 10.4 (both Intel and PPC) all the way up to 10.8 Mountain Lion.

What's that you say? Macs don't need Antivirus? are we still arguing that old point? Well then, yes they do!

At the SecTor security conference at the beginning of October, Seth Hardy will be talking about a new development in Mac malware attacks. Targeted attacks:

APT ALL THE THINGS: are Mac users no longer safe? - Seth Hardy

A new development of 2012, targeted attacks (APTs) against human rights now often include malware specifically designed to compromise Macs. Mac users have long thought they're safe, for a variety of reasons including: "nobody ever targets us" (not anymore!), "Macs are based on Unix so have additional security" (not if new vulnerabilities are found, or you choose to run the program), and "we're not using Internet Explorer or Outlook so most threats don't work" (other software can be just as buggy).

One region in particular has started using malware "bundles" that detect the target's operating system and serve up the appropriate program to compromise computers within NGOs and other human rights organizations. This is a relatively new development, with names starting to become more familiar: e.g. SabPab (related to the known LuckyCat campaign), Lamadai, and MacControl. This also coincided with the rise of the Flashback botnet - a Mac-specific botnet believed to at one point be over 600,000 strong. In this talk we'll look at targeted Mac malware, observe similarities and differences to "conventional" targeted attacks, and go over some end-of-year thoughts as to where Mac malware may be going next.

For home users on PC, you can get Sophos' virus removal tool  for free, but if you want the real deal, you have to buy at least 6 licenses of the coprorate product.  While it is good, I'd recommend most home users on PC look at another product.

Amazon Releases Another Set Of New Kindles

Today Amazon announced it's newest line-up of Kindle devices.


The big news on the LCD tablet side was the Kindle Fire HD with a high definition screen and more processing power than last year's fire, it comes in 7" and 8.9" versions, and the 8.9" has an LTE cellular option. Various storage capacities are available.

and...


The Kindle PaperWhite was released on the e-ink e-book reader side of the kindle lineup, with a crisper, whiter screen, a front light and enough battery to last you 8 weeks even when using the light! It comes in WiFi only and WiFi/3G versions.

OpenDNS to prevent Malware, Phishing, and Porn

A parent I know was wondering last week what she could do to block her kids from going to websites of questionable educational value for children of a young age if Chrome was installed on their computer.

Previously she'd been using the Windows Live parental filters built into recent Internet Explorer versions. I suggested she look at OpenDNS as you can set filters and any computer using the OpenDNS DNS servers, regardless of browser or even operating system, would be blocked from going to sites in your blacklisted categories. Thus, this solution, if implemented right in the house's internet router, would also work for the kids' iPods, and any other devices they had that could connect to the internet.

Personally, I have OpenDNS enabled on my home network with only Malware and Phishing sites blocked. This allows an extra layer of protection from accidentally browsing to a malware infected site over the Google blacklist that many browsers use.

You set up an account and set whatever settings you want for web filtering, and give them your external (internet) IP address to tie those filtering rules to, then set OpenDNS's DNS servers in your router or computer's IP settings. Don't worry, if you don't know how to do that they offer plenty of helpful instructions.

What if you are with an Internet Service Provider that gives you a different address each time you connect, or you want that protection on a laptop that moves from network to network getting new IP addresses all the time? They have an app for that. (sorry Apple)

OpenDNS Updater is a tiny app that sits in the system tray by your clock and periodically updates the IP address they have on file for your account.

Make Your Gmail Harder to Break Into

If you have a phone (not even a cell phone is necessary) or access to paper and a pencil, you could be using 2 factor authentication with Gmail and other Google services... well, if you only have paper and pencil it's not strictly speaking going to be 2 factor, but 2 part, one-time use passwords, which is almost as good.

I could go into a step by step of how to do it, but Google has already done that for me, with videos and screenshots and everything, just follow the link below.

http://goo.gl/qpY26





I just set my account up, added my cell phone as an SMS phone I could receive codes at, my home phone # as a backup voice phone I could receive codes at, copied the one-time use passwords for emergencies into a keypass file, and set up Google Authenticator on my blackberry. It took all of 10-15 minutes to do and I have 2 factor auth with several backup options in case I lose my Blackberry phone. ...so I can feel even more sure somone will not be able to easily hack my Google account from the Ukraine or somewhere else where hackers are plentiful, but also confident that I am not going to lose access to it myself.

VoIP at home

So, I've been playing with VoIP for years. I have set up an asterisk machine, (both as a service on my existing Linux box, and as a VM... many different iterations of the VM), I've had a commercial VoIP phone line from Primus, and later took the Sipura SIP ATA that I had been using with Asterisk and used it with various VoIP wholesalers directly, and in the end this is the solution I have come up with that works best for me:

Service Provider: voip.ms
SIP ATA: Cisco SPA122 (This is the box that all your old fashioned analog phones plug into)
Desk Phone: Grandstream GXP2000 (used for business line and house line)
Spare SIP ATA: (because it's a little buggy and I don't have time to figure out why, so I plan to use it for travel) Sipura SPA-3000, which is no longer made, but it is the predecessor to the newer Cisco/Linksys SPA-3102

Originally the Sipura SPA-3000 provided a way for me to take my hard wired phone line (hooked up to the FXO port) and feed it into asterisk, then come out of the asterisk box as an extension (connected to the FXS port) connected to all the phones in the house, using the asterisk box as a way to route some calls over the internet, and to provide interesting IVR/answering machine features on incoming calls. (for example, I found I got almost no telemarketer calls if I simply had it send all unrecognized phone numbers to a menu that simply said "press 1 to ring the phone, or stay on the line to leave a message"

Nowadays I have no hard wired voice line. I have my phone number set up as a DID at  voip.ms and then each of my SIP devices register as a separate sub-account (extension) there. The DID rings to a Ring Group made up of all of the extensions, so all of the phones will ring when the house phone number is dialed. I filter any telemarketers through CallerID Filtering, sending most to either a "this number is no longer in service" message or just a straight hangup. Charities are treated a little bit better, they are sent to a message saying that their number has been recognized as a charity and that I don't give money over the phone, but if they want to get a message to me they can send an e-mail. ...and that I get a lot more calls from clothing drives than I have clothes to give, so if they are calling on behalf of a clothing drive I have nothing available. That basically takes care of most of the telemarketers and other annoyances. Filters for obvious fake phone numbers also help. By that, I mean numbers that are too short to be actual phone numbers...telemarketers use VoIP too, and sometimes either by mistake or on purpose, they fill out the "outgoing number for caller ID" field wrong.

So, if you are looking at the specs of the Cisco ATA, you will notice that there are 2 phone ports (FXS ports). My idea for that is to hook some of the phones in the house up to one port and some up to the other and have each port register as a separate extension. Not only will this allow 2 simultaneous calls from the same house at no extra cost (except per minute usage fees) it also adds a bit of redundancy in that if one extension fails to register properly with the voip.ms servers, the other may still work. They all still ring when the phone number is called due to the ring group setup explained earlier. That is, unless someone is currently talking on the phone. In that situation other phones on that same extension will not ring.

What does all of this cost? aside from the purchase cost of equipment (which was not terribly expensive) I pay $0.99/month for the DID, and per minute usage for both incoming and outgoing calls. In the month of May the usage added up to $19.16, in June the usage was $15.26, in July it was $1.31 yes that is one dollar and thirty one cents. I guess we didn't make as many long distance calls in July. Yes, you pay for local calls too, but the rate is so ridiculously low that it doesn't matter.

I have also found it useful to set up an IVR for incoming calls from my cell phone that lets me press 1 to ring the house phones or 2 to leave myself a voice mail (which automatically gets saved as a .WAV file and e-mailed to me, so it is useful if I just want to take a quick note of something) or 3 to dial out, in case I want to make a long distance international call and not have it billed to my cell phone.

Sophos

This is going to sound like a sales pitch, but I assure you I am not being paid by Sophos to say this.

I've been deploying Sophos Anti-virus at work in stages over the last month or so, and I am continually amazed at how many of the JavaScript Trojan droppers and Fake Antivirus programs it is finding in people's temp and temporary internet files, or buried in system restore points that the previous antivirus just plain missed.

I'm not talking about bleeding edge definitions for variants that just came out the day before the switch either. I'm talking about stuff that's been sitting in temp for months in some cases.

If you are curious how it'd do in your environment, download the free removal tool and run a one time scan of your system. or sign up for a trial of the full thing. It really does find stuff that the other guys miss. http://www.sophos.com/en-us/products/free-tools/virus-removal-tool/download.aspx

Sophos doesn't have a home user product like most of the other antivirus companies, but even for small businesses they have packages that are fairly affordable, especially if you bundle several products. With our government pricing we managed to get a replacement for our antivirus including e-mail servers, plus a spam appliance as a VM and mobile device management, endpoint encryption, and a few other things for about what we were paying for maintenance on the anti-virus parts with another company.

IT Security Training

People occasionally ask me what kind of training and courses to take to get into IT Security.
I think the best summary I have found is in this CompTIA Roadmap graphic: (click to go to the interactive one on CompTIA's website)

 


Basically, get your self started in IT. If you have absolutely no computer experience start with an A+.
Then, for the most part, I agree with this map in terms of what falls into the Beginner, intermediate, Advanced, Specialist and Expert categories. I think C|EH could probably be moved down a notch or two though.

I don't like CompTIA's career path lines though. If you think you can go MTA Security, Sec+, CASP, CISA, CISSP and ignore all the stuff on other lines... you will be really disappointed.

Basically you want to get on any other line besides the training path (that's pretty much a dead end unless you just want to teach)  I would say Networking, Network Admin, or Services/Helpdesk would be good starting points, and pick up equal level certs on the security line as you go along.

If you don't have a solid background in SOMETHING, whether that be networks, operating systems, databases, whatever... you won't be able to handle the security.