Featured Posts

<< >>

Labor Stats For Labor Day

Some numbers reflecting when US workers stand this Labor Day Infographic Courtesy NBC News Ralph Bach has been in IT for fifteen years and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.

Millions of PC’s Still Have Stuxnet Bug

Lately I have been covering quite a few pieces of old IT business here, here and here. And here is another piece of old business from Infosecurity Magazine. Tara Seals at Infosecurity Magazine recently pointed out new research from Kasperskey that there are 10′s of millions of systems that are still vulnerable from one of the

What If Your Phone Lands in the Loo

If you are one of the 75% of Americans who use their mobile in the Lav and your phone took a dip in the toilet (or other liquid for that matter), unless you have a waterproof Galaxy active you need this infographic from The Roosevelts. You need to act fast and follow this handy guide

MSFT Clossing More Windows Support

IT departments organizations are busy keeping up with XP replacements, Cloud migrations, BYOD implementations and now Microsoft has reminded everybody that there are other fires burning on the horizon. Microsoft (MSFT) is warning that they are ending mainstream support for more popular Windows products. Some of the key products ending mainstream support include; Widows 7, Window

Password Free Future

Lets just admit it, passwords suck, people don’t use good passwords. Password breaches seem to be the new normal. Firms are being forced to find new ways of verifying their users and securing their data. Now, security firm Trustwave says traditional password policies are useless. According to an article at Infosecurity Magazine the Chicago based

Labor Stats For Labor Day

Some numbers reflecting when US workers stand this Labor Day

Infographic: Labor Day by the Numbers

Infographic Courtesy NBC News

Ralph Bach has been in IT for fifteen years and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.

Millions of PC’s Still Have Stuxnet Bug

Millions of PC's Still Have Stuxnet BugLately I have been covering quite a few pieces of old IT business here, here and here. And here is another piece of old business from Infosecurity Magazine. Tara Seals at Infosecurity Magazine recently pointed out new research from Kasperskey that there are 10′s of millions of systems that are still vulnerable from one of the most infamous malware families.

RadarResearch by Kaspersky has found the vulnerability that allowed Stuxnet, Flame and Gauss malware campaigns (CVE-2010-2568) is still being exploited despite the flaw having been patched in late 2010 by Microsoft. The article reports that Kaspersky Lab detection systems recorded more than 50 million detections on more than 19 million computers worldwide in the past eight months.

The lack of patching by IT administrators is surprising given that the vulnerability has an infamous history. The author explains that the vulnerability is an error in processing tags in Microsoft (MSFT) Windows OS, which enables the download of the random dynamic library without the user’s awareness. The vulnerability affects Windows XP, Vista and Windows 7, as well as Windows Server 2003 and 2008.

MalwareThe first malware exploiting this vulnerability appeared in July 2010: the worm Sality, which generates vulnerable tags and distributes them through the LAN. Ms. Seals writes that if a user opens a folder containing one of these vulnerable tags, a malicious program immediately begins to launch. The summer of 2010 then saw the appearance of Stuxnet, a computer worm which was specifically designed (likely by the US and Israel) to sabotage the uranium enrichment process at several factories in Iran. Subsequently, the state-sponsored Flame and Gauss spyware made use of the security hole.

Infosecurity Magazine dug deeper into the statistics and found that most of the unpatched systems are running Windows XP, Microsoft‘s outdated OS. Kaspersky said in a report;

Knife in toasterThe lion’s share of detections (64.19%) registered .. involved XP and only 27.99% were on Windows 7 … Kaspersky Lab products protecting Windows Server 2003 and 2008 also regularly report detection of these exploits (3.99% and 1.58% detections respectively)

Kasperskey data suggests that the problem is self-inflicted

The large number of detections coming from XP users suggests that most of these computers either don’t have an installed security solution or use a vulnerable version of Windows – or both.

Kasperskey also analyzed the geographical distribution of the CVE-2010-2568 detections and according to Infosecurity, the top nations with the vulnerability Globewere:

  1. Vietnam (42.45%)
  2. India (11.7%) and
  3. Algeria (5.52%)

Kaspersky researchers told the author, “So many users of outdated versions of Windows mean these exploits are effective even though almost four years have passed since the disclosure and patching of the vulnerability.”

rb-

C’mon, if your going to use an orphaned operating system, update it as far as you can and get off it as fast as possible.

As Kaspersky pointed out, using an outdated version of an operating system is fraught with the risk of cyber-attacks involving exploits, special programs that target vulnerabilities in legitimate software to infect a computer with other dangerous malware.

 

Ralph Bach has been in IT for fifteen years and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.

What If Your Phone Lands in the Loo

What If Your Phone Lands in the LooIf you are one of the 75% of Americans who use their mobile in the Lav and your phone took a dip in the toilet (or other liquid for that matter), unless you have a waterproof Galaxy active you need this infographic from The Roosevelts. You need to act fast and follow this handy guide to save your beloved piece of tech.

How To Fix A Phone That Has Been Dropped In A Toilet

Ralph Bach has been in IT for fifteen years and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.

MSFT Clossing More Windows Support

MSFT Clossing More Windows Support IT departments organizations are busy keeping up with XP replacements, Cloud migrations, BYOD implementations and now Microsoft has reminded everybody that there are other fires burning on the horizon. Microsoft (MSFT) is warning that they are ending mainstream support for more popular Windows products. Some of the key products ending mainstream support include; Widows 7, Window Server 2008, Exchange 2010 and SharePoint 2010.

Microsoft SupportSo what does Redmond mean when it ends “Mainstream Support”?

  • Mainstream support is the typically five-year period when Microsoft provides free patches and fixes, including but not limited to security updates, for its products.
  • When a product exits the mainstream support phase, Microsoft continues to provide a period (also often five years) of extended support, which means users get free security fixes but other types of updates are paid and require specific licensing deals.
  • “End of support” means there will be no more fixes or patches — paid or free, security or non-security — coming for specific products. CNET says there are some temporary work-arounds, as Windows XP users have discovered, but as a general rule, end of support means, for most intents and purposes, the end.

calendarHere are some critical (or not so critical) dates. You may want to circle in red on your calendar and start planning now. Do you have funds in your 2020 capital budget for new hardware? Will cloudifying these be the answer? Are you up to speed on Azure? Are your apps up to speed on Azure?

September 14, 2014 mainstream support ends Windows Phone 7.8.

October 14, 2014 is a critical date, support ends for

  • Office 2010 (Including Viso and Project) with Service Pack 1 mainstream support ends.
  • SharePoint Server 2010 Service Pack 1 mainstream support ends

Alarm clockJanuary 13, 2015 is a big day for Microsoft support

  • Windows 7, Mainstream, free support ends on for all versions of  Windows 7 (Enterprise, Home Basic, Home Premium, Ultimate and Starter) as wall as Windows 7 SP1.
  • Extended support for Windows 7 lasts until January 14, 2020, so users can expect to continue to receive free security updates, but not feature updates, for Windows 7 until that point.
  • Some industry watchers have speculated that Microsoft will end up pushing out Windows 7′s support dates the way the company did for XP, given Windows 7′s popularity and pervasiveness, but so far, CNET says there is no evidence of it happening.
  • Windows Server 2008 – Mainstream support also ends on all versions of Windows Server 2008 and 2008 R2. Extended support remains in place until 2020.
  • Exchange 2010 – Mainstream support will also end on all versions of Exchange 2010. Extended support remains in place until 2020.
  • Other Microsoft products whose mainstream support ends on January 13, 2015 include :
    • All editions of Windows Storage Server 2008,
    • Dynamics C5 2010,
    • NAV 2009 and NAV 2009 R2
    • Forefront Unified Access Gateway 2010 with SP3
    • Visual Studio 2012
  • Microsoft recommeds its customers to get updated, “Customers should migrate to the next available Service Pack to continue to receive security updates and be eligible for other support options.”

extended support period for Server 2003 cuts off July 14, 2015 Microsoft’s extended support period for Server 2003 cuts off (I covered the end of 2003 here). MSFT won’t be issuing patches, updates or fixes of any kind for that operating system (unless users have pricey Custom Support Agreements in place). Redmond is hoping to move 2003 hold-outs to Windows Server 2012 R2 and/or Azure.

October 13, 2015 is another big deal day

  • Office 2010, Visio 2010, Project 2010 — Mainstream Support ends. Extended support should run into 2020.
  • SharePoint Server 2010 — Mainstream support ends. Extended support should run into 2020.

April 11, 2017 – Extended Support ends for Windows Vista ends. No more updates. Time to upgrade (rb- if you haven’t already moved on).

August 11, 2017 – Extended Support ends for Exchange Server 2007. No more updates. Time to upgrade.

January 10, 2018 Mainstream support for Windows 8.1 ends for all versions of Windows 8. Customers still running Windows 8 have until January 12, 2016 to update to Windows 8.1 in order to stay supported.

rb-

Remember this – running out-of-date software which no longer receives security updates is playing into the hands of online criminals and hackers.

Ralph Bach has been in IT for fifteen years and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.

Password Free Future

Password Free FutureLets just admit it, passwords suck, people don’t use good passwords. Password breaches seem to be the new normal. Firms are being forced to find new ways of verifying their users and securing their data.

Business Insider - The Worst Company Data Breaches Ever

Longer passwords are more secureNow, security firm Trustwave says traditional password policies are useless. According to an article at Infosecurity Magazine the Chicago based firm says mixing upper and lower case letters, numbers and special characters doesn’t make passwords any harder for hackers to crack, only increasing the number of characters makes passwords more secure. Will we end up with 1,024 character secure passwords. I say lets ditch passwords all together.

What else can we use to secure our ID’s? John Hawes at Sophos Naked Security Blog recently bemoaned the state of the clunky, fiddly and mostly rather insecure passwords we use for almost all of our authentication needs. He says we may not be stuck with passwords forever. He offers some future options.

Password dogFacial Recognition – The author cites Australian researchers who have been promoting facial recognition as a means of authentication. This idea seems obvious, faces are the main way people identify each other in the real world, so it makes sense to have computers recognize our faces, or at least bits of our faces. The Sophos article says the approach has become common of late, with PC login systems and mobile apps trying to use our faces to authenticate us to various things. There is even a Finnish company that plans to use faces in place of credit cards.

The anti-malware firm says facial recognition systems have proven less than perfect, either easily fooled by photos, similar-looking people or technical tricks, or failing to authenticate real users thanks to bad hair days or bad moods affecting how we look.

Passwords are like pantsMr. Hawes says University of Queensland researchers are trying to improve accuracy and security of facial recognition. The Aussies are working to be able to get facial recognition to work from a single initial still image and from different angles and different lighting conditions, which sounds like a must for any decent recognition system.

The good thing about face recognition, the author says is that it’s relatively low-tech, using a standard part (the rear-facing camera) of most of the devices we use. The software looks for patterns on the human face, such as distance between eyes, to identify people. But the researchers expect it will take more time to have a fool-proof working prototype.

Facial recognitionCNN points out that security is great for consumers, but it’s not the primary goal of most facial-recognition tools. Law enforcement and spy’s are building databases (PDF) to take advantage of recent advancements in facial recognition. Identifying one person using their trail of selfies left online and in surveillance footage from stores could be a huge business. Some stores already use facial recognition to build profiles on repeat customers and collect data about how they shop.

Facebook (FB) recently bragged that its own facial recognition project named DeepFace, was almost as accurate at detecting people as the human brain. More recently, it also claimed to be able to recognize faces from the side as well as the front.

EarEars - CNN reports that with the right software, a phone can detect the shape of a human ear and use it to login. That’s the idea behind the Ergo Android app by Descartes Biometrics. When an ear is pressed against the screen, the points where it makes contact with the glass are mapped out and compared to a stored ear print. If it matches, the user is authenticated. The app is adjustable and can require multiple scans for the highest levels of security.

For now, it’s limited to unlocking a phone. But CNN claims ear prints could be used to identify people for any number of uses on the phone, such as making purchases in app stores or signing into services.

WalkingCNN says that if you’ve ever identified someone by how listening to how they walk down the hall, you’ve already seen the power of gait recognition. For 30 years, researchers have tinkered with gait-recognition technology but the recent boom in inexpensive motion sensors like accelerometers and gyros have given new life to the field. CNN reports that with the right software and sensors, they should be able to analyze a person’s walk. A wearable fitness device or smartphone can authorize users.

The benefit of gait recognition is that it can gather the necessary information in the background while people go about their normal routines. There’s no need for the subject to touch their device or look into a camera.

KeyboardTyping - Like walking, typing varies from person to person according to CNN. Keystroke biometrics record how a person types and calculates their unique pattern, speed and rhythm. It determines how long they hold down each key and the space of time between different letters. Keystrokes could be used to authenticate anyone working on a computer, so the system could appeal to companies that are watching out for unauthorized users on their internal systems.

Gestures - Gesture-based authentication is another potential password replacement emerging from the world of smartphones and tablets. Mr. Hawes says hand movements repeated often enough can lead to muscle-memory, so quite complex patterns can become quite easy to reliably and accurately reproduce. This is the basis of a very venerable form of authentication, the signature. It should be harder to compromise though, as unlike signatures,  swipes leave few traces to be copied.

AnSwipedroid phones have long had swipe-pattern unlock features, and Microsoft (MSFT) Windows 8 includes a system based on a few swipes around a picture. Research has poked some serious holes in this approach though, showing that people are just as bad at picking hard-to-guess shapes as they are at choosing passwords.

Besides monitoring you body to authenticate you, there are hybrid authentication technologies. Hybrid authentication combines biometric factors with other techs.

Brain wavesBrain waves - I covered the Interaxon Muse headband sensor device a wile ago. It is designed to allow users to create a specific brain wave signature for a password that will never have to be said or typed to login.

Biostamps -  The biostamp idea proposed a hybrid of body and technology. The biostamps are flexible electronic circuits attached to the skin, which theoretically can communicate wirelessly with any device which needs to check who you are.

Bracelets - Another hybrid approach uses a bracelet device which measures heart rhythms to check who we are, and then connects to our devices via Bluetooth to pass on that confirmation. I covered Nymi here.

The actual authentication takes place only when the bracelet is first put on. It requires a quick touch of some sensors, and from then on it will confirm you’re you until it’s removed. It includes motion sensors, so the basic authentication can also be combined with movements and gestures to create multi-factor passwords, using both the body and the mind of the attached user. Gestures could be used to unlock cars, for example.

Over the years the password systems we use have seen various improvements, both in usability (ranging from simple but today’s indispensable systems for replacing forgotten passwords to the latest secure password management utilities) and security, for example two-factor authentication schemes using dongles or smartphones combined with our computers.

All have helped in some ways, but have also introduced further opportunities for insecurity – recovery systems can be tricked, management tools can have vulnerabilities or simply be insecurely designed, and two-factor approaches can be defeated by man-in-the-mobile techniques.

rb-

Biometrics are not bullet-proof. They have a number of problems still.

  1. Biometric data cannot be changed once it is compromised.
  2. Will stress, fitness, or aging, have on the physiological elements of biometrics.
  3. Cost, most of these techniques require new equipment.
  4. They all need connectivity, Bluetooth connectivity.
  5. Biometric data still needs to be stored somewhere. And that would be an attractive target for attackers.

Ralph Bach has been in IT for fifteen years and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.