Thursday, April 30, 2009

Adobe Reader Vulnerability

The latest Adobe vulnerability that was announced on Tuesday is now being exploited in the wild. CERT recommends that JavaScript be disabled until Adobe patches the software.

To disable javascript in your Adobe reader software, go to Edit -> Preferences and under Categories select JavaScript. Remove the check from the "Enable Acrobat JavaScript" box.

Once Adobe releases a patch and your system has been updated, you can re-check this box.

Tuesday, April 28, 2009

McAfee launches free online cybercrime help center | Security - CNET News

McAfee launches free online cybercrime help center | Security - CNET News

CNET is reporting that Network Associates has announced they are opening a free cybercrime help center. The McAfee Cybercrime Help Center is being touted as a first-stop if you believe that your computer has been compromised by a virus, worm, or other malware.

I'm sure that this tool will be an excellent resource for McAfee to track trends in computer viruses and identity theft schemes, so it's no surprise that it's free, and I'd suspect that they will also be collecting marketing information from people who visit the site and complete their "assessement", however it's nice to see a company working with end-users to identify new threats and potentially track and resolve cybercrime related issues.

While the help center is free, it will be interesting to see if the solutions are entirely free... and what effect this new tool will have in the world of computer security software firms. Personally, I think that this is the first sign of a change in how companies like Network Associates and Symantec approach computer protection... it's obvious to me that user education is the only truly effective tool in the fight against cybercrime. Perhaps we're seeing a shift to a focus on training instead of merely relying on technical prevention?

Monday, April 27, 2009

Back It Up

In both Vista and OS X it is now extremely easy to create a backup of your files. Additionally, the cost of large external hard drives has dropped so low that even in this economy most people can afford to purchase half a terabyte or more of external drive space. Despite these facts, the percentage of people who back up their home computer is still very, very low.

I think most of my readers would agree that the time to find out that you need to back up your files is not after you've experienced a hardware failure. However those are exactly the circumstances under which many of the users that I interact with on a daily basis will eventually come to this discovery. Every time I sign up a new client I advise them to implement a backup system that, at a minimum, backs up their important files weekly, and only 10% of them take this advice to heart, even after years of continued admonitions regarding the risks of not keeping backups.

So, to keep you from becoming another statistic for me to blog about, here is a quick and easy guide to backing up your computer:

Macintosh OS X

The Leopard version of OS X includes about the simplest backup system in the world, Time Machine. To keep your Mac backed up, all you need to do is buy an external drive (either USB, Firewire, or wireless) and plug it into the Mac. You will be prompted to use this drive for Time Machine. Say yes, and you're done. As long as you connect this drive for a few hours once a week you will have a running backup of your important files.

Vista

The Vista operating system offers the Backup and Restore Center which allows you to configure an automatic backup of your PC. You can access the Backup and Restore Center under your Control Panel. If you've been using your computer without a backup for a long time, I always recommend making a backup image of your whole PC on CD-ROM or DVD prior to setting up your scheduled backups. Luckily the Vista Backup and Restore Center has wizards that make this easy for you; simply select "Back Up Computer" and follow the wizard, once this is done go back into the Backup and Restore Center and select Back Up Files to set up a daily or weekly backup of your PC.

XP and Third Party Vendors

If you have Windows XP, it is easier and more reliable to use a third party application to back up your files. Fortunately, most external hard drives come with some kind of backup software. Be sure to check the packaging for the hard drive that you buy and make sure that the included software is not a trial version! At the very least you can use the included XP backup application (under Start -> Accessories -> System Tools -> Backup) to manually run a backup, having some kind of backup is better than none.

Lastly, I want to advise that a backup of some kind is made a couple of times a year and stored off-site in a safety deposit box, at a friend or relative's house, or uploaded to an online backup service like Upline or Mozy. If a natural disaster occurs, you don't want to lose your backups along with your computer.

Now more than ever most of our important photos, correspondence, music, and financial information are in digital format and it's important that these things are protected from loss.

Thursday, April 23, 2009

Service Accounts

In my experience one of the most difficult security holes to plug is when a domain administrator account is used improperly on a Windows domain. All too often I see a domain administrator account used when software is deployed when a service account should have been established instead.

The modern Windows network running Active Directory will likely outlive many of the applications that are installed on it. Maintaining the directory and all the accounts in the directory can be made far more difficult if it isn't clear what these accounts are being used for. Additionally, if you are relying on just one or two accounts with broad rights on your domain in order to get things done, you are making it very hard to protect your network from disgruntled employees... it's hard to change the password for an account that impacts so many different applications.

It is always a good idea to set up a new service account for every application that requires domain access, and to delegate the minimal rights that account needs. When it is clear which accounts are used for what application, directory maintenance becomes a snap! You immediately know which accounts are still in use, and which accounts can be safely retired once an application is removed from the domain.

While the domain administrator account is "god" of the domain, and it is tempting to just use this type of account to avoid the permissions issues that can happen when a service account needs special rights, it is always a bad idea to use this account for anything other than its intended use, which is administrating the domain. If you can resist the temptation to use this account, and take the time up front to create specific service accounts for your applications, you will actually be saving yourself a lot of time down the line. And you'll have a more secure network to boot!

Wednesday, April 22, 2009

Experts: Malicious program targets Macs - CNN.com

Experts: Malicious program targets Macs - CNN.com

Just a quick reminder that all computers should have anti-virus software installed, and that in the long run it's much cheaper to pay for your software instead of trying to get it for "free"...

Tuesday, April 21, 2009

Secure Your Wireless Network... Please!

In this day and age of high anxiety regarding identity theft and credit card abuse one would think that keeping information secure would be a top priority for computer users everywhere. This is why I'm surprised by how many people don't take the time to secure their wireless networks in their home or home office.

In the past I have even gone so far as to demonstrate to my customers just how easy it is to snoop on their Internet activity by sitting in their driveway with my laptop and compiling all the information I can about them (with their permission of course). They are often shocked by just how easy it is for someone to obtain information that they thought was secure via their open wireless network connection.

And that's just the security and privacy aspect of it! I recently had a new client whose Internet had slowed down considerably, she was convinced that she had a virus or some other computer malady. When I came by to investigate I discovered that several people in her complex were freeloading off her open wireless connection, she had become the "free Internet" for the other condos in her area.

There are two things that I recommend everyone do to secure their wireless network, and a third tip if you want to be really secure. The first two steps are easy to implement, and are usually covered in the setup guide for your wireless router or access point:

1) Change the default password and identification (SSID) on your wireless router/access point. I have ever had clients who installed their own wireless network and end up having to call me because some prankster has locked them out of their own network using the default password for their router.

2) Set up some kind of encryption in your network. I prefer to use WPA, however WEP is better than nothing. This accomplishes two things: firstly, it means that in order to connect to your network a password is required, secondly it means that the traffic between your computer and the Internet, printer, and other machines on your network cannot be easily captured and viewed by a third party.

My final, more advanced, tip is to enable MAC address filtering. Every network card has a sort of serial number called a MAC address, and by setting up your router so that it will only accept connections from certain network cards, you have an added layer of security on your network. On a Macintosh running OS X you can find your MAC address by going to System Preferences -> Network -> Airport -> Advanced, the MAC address is the "Airport ID". On a PC, open up a command line (Start -> Run -> cmd) and type in 'ipconfig /all' (no quotes), the MAC address will be the "Physical Address" in the output. You can follow the instructions for your particular wireless router to enable filtering and enter the MAC addresses from all the devices on your network as the only machines allowed to connect.

By securing your network you are not only protecting your personal information, you are also making sure that the Internet bandwidth you pay for is reserved for your use!

Monday, April 20, 2009

IT Support - Customer Service

I have a friend who is a medical doctor, and he often complains that he has to deal with patients who come into his office with symptoms that they have "self-diagnosed" and that nine times out of ten the treatment that they request, or the ailment that they think they have, is not even close to their actual problem.

It may sound obvious that the key to providing excellent I.T. support is knowing what your customer or end-user wants to do and providing them with the tools to do it, however I am surprised at just how often I witness I.T. support personnel treating the symptom instead of the disease.

There is nothing more frustrating to an end-user than going to their I.T. support person and asking for help only to receive "assistance" that doesn't get them where they want to go. Time and time again I witness I.T. support give the user exactly what they asked for, only to have the end-user go away frustrated because what they wanted wasn't what they needed.

Any time I am approached by an end user I am sure to work one specific question into the conversation early on. That question is "What are you trying to do?" My goal in assisting an end-user is to make sure that I understand what they are trying to accomplish, once I am sure we are on the same page for the end result, then we can start discussing the "how".

If more I.T. support personnel would take the time to understand what their end users are trying to accomplish, they could save a lot of frustration on both sides by no longer having to solve "problems" that don't even exist. By keeping the focus on the end result, you can be sure that you and your user are both working towards the same goal.

Saturday, April 18, 2009

Keeping an Inventory - Print it Out!

Just having an inventory is a huge step in the right direction for the small to mid-size organization, however if your network or workstations are down, and you only have a soft copy of your inventory, it won't do you much good. Especially if you need the information to get things back up correctly.

This is why it's very important to keep a hard copy of your inventory up to date, organized, and close at hand. If you print out your inventory database whether it's in a spreadsheet, database, or just a word processor, throw it in a binder, and lock it in your desk, I guarantee you that there will come a day where that binder will be worth its weight in gold!

I would get in the habit of updating the hard copy of your inventory at least once a week, it's usually the last thing I do on Friday. This way you know that at any given time your hard copy is no more than 5 working days (well, 7 if your working days are like mine) off from reality. Of course if you do major deployments or upgrades you should be sure to make an exception to this rule and update early... when big changes happen there is a greater chance of something going wrong, and taking a few minutes to update your inventory could save you a lot of time if this happens.

Wednesday, April 15, 2009

Microsoft's Patch Tuesday filled with zero-day exploits - Network World

Microsoft's Patch Tuesday filled with zero-day exploits - Network World

Network World has an article about how Microsoft's "patch Tuesday" for this month contained several patches for vulnerabilities that already have exploits in the wild.

The quote from the article that I want to talk about is from Wolfgang Kandek, "That window where you had the luxury of not patching, that is shrinking fast". In my post from last Thursday regarding the Conficker worm, I mentioned that it's a good idea to set your computer to auto-update overnight, and to leave the machine on overnight once a week. If you have a Microsoft machine, I recommend that the night you choose be Tuesday, as most of Microsoft's patches are released on Tuesdays.

Like Mr. Kandek says, the window between vulnerabilities in computer software being discovered and exploits being released is getting smaller and smaller, your best protection is to make sure that you have the latest patches for your software installed.

Saturday, April 11, 2009

Keeping an Inventory - Dell Service Tags

On Thursday I talked about the value of an inventory and how it can come in handy if you need to call for service. Most of the companies I work with use Dell workstations and servers. These machines have a service tag, a serial number that the support technician will need in order to access warranty information for the machine. This is another time that you may end up finding yourself crawling under a desk or squeezing between cabinets in your server room to get information in an emergency.

Once again, I have a workaround for you. You can use this Visual Basic Script to pull the service tag from the machine that you're logged into:

----------
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colSMBIOS = objWMIService.ExecQuery _
("Select * from Win32_SystemEnclosure")
For Each objSMBIOS in colSMBIOS
Wscript.Echo "Service Tag: " & objSMBIOS.SerialNumber
Next
----------

Simply copy the code between the dashes (do not copy the dashes) and save it to a file called "delltag.vbs". Run this file on the machine where you are trying to get the tag, and it will pop up a window with the service tag information.

Again, it is best to be proactive and do this before you have a problem. If you find yourself with a dead computer or server and you don't have this information handy, you will be getting your hands dirty searching for this information on the machine itself, which, in an emergency, can be more than just an inconvenience, it can be the difference between meeting your service level agreement or missing it!

Thursday, April 9, 2009

Conficker wakes up, updates via P2P, drops payload | Security - CNET News

Conficker wakes up, updates via P2P, drops payload | Security - CNET News

CNET updated its article about the Conficker worm. This worm has been getting a lot of press lately, and you can find lots of information on it so I'm not going to bore you with the details.

What I do want to do is use this as an illustration of how important it is to keep your computer patched! The patch for the exploit that this worm uses to infect your system came out almost six months ago. If you set your computer to automatically update every night at 3:00am, and then just leave it on overnight once a week, you never have to worry about worms like Conficker that rely on old vulnerabilities to infect your system.

Keeping an Inventory - Retrieving Machine Specs

One thing that can be a real pain is having to crawl under a desk, hunt around a server room, or pore through file cabinets in order to find out what the hardware specifications are for your Windows computer. One way to avoid this is to keep a list of all your machines with these specs and service tags handy. Unfortunately, unless you started this list when you first purchased your computer(s), you are dreading all the crawling, hunting, and poring that will be required to compile an initial list.

Fear not! There are a few simple commands that you can run from the comfort of your desk that will allow you to get a lot of this information without having to get out the dust mask. The first two are run from a command line (Start -> Run -> cmd):

systeminfo - This command will return all kinds of useful information, including your OS version, install date, computer model, processor information, amount of memory, domain name, and patches installed.

ipconfig /all - This command will give you information on your network adapters, including your IP address and your network card model.

There is also quite a bit of information that can be found in the graphical interface. By going to your "My Computer" icon, right-clicking on it, and choosing "Manage", you can access the Disk Management applet that will give you all the information about your disk drives (both physical and logical).

With the information from these three places, you can build a pretty good database of what hardware you have installed, which is a very handy thing to have on hand before your computer crashes... especially handy if the hardware is under warranty, as you can call the manufacturer and give them all the information that they need without having to get your hands dirty!

Welcome - Starting a Technical Blog

Hello, and welcome. My name is Jonathan, I have been gainfully employed in the I.T. field for thirteen years, however I have been an I.T. enthusiast and hobbyist for most of my life.

I currently run a "boutique" computer consulting firm out of the San Fernando Valley in Los Angeles that handles everything from first-time computer training up to mid-size company deployments and support. I also have a day job doing network security for a manufacturing company.

It is my hope that this blog will be useful to my clients and general readers who are not technical, yet I also hope that it will be a good place for me to share technical information with my colleagues about existing vulnerabilities, I.T. issues, and best practices.

So take a look around, I hope that you find something interesting!