Tag Archive for 7

PC Market Show Signs of Life

PC Market Show Signs of LifeAfter 7 years of consistent declines – PC sales finally stopped their slide. Market researchers Gartner and IDC reported that PC sales grew during the fourth quarter of 2019, boosting all of 2019 into the positive. For the entire year, global PC shipments were up 2.7%, according to the IDC. That makes 2019 the “first full year of PC growth” since 2011.

Sick computerPCWorld reports that 2019 new PC numbers from Gartner and IDC and are remarkably similar. Gartner reported that PC sales grew 2.3% in 2019 Q4 to 70.6 million units and 261 million units for the year. Rival analyst firm IDC largely agreed, estimating that PC unit sales grew 4.8%, to 71.8 million units. IDC said that worldwide PC sales grew 2.7% for 2019 as a whole.

Among the results:

  • The top three global PC vendors—Lenovo, HP, and Dell—all consolidated their market share, reaching 65% of the PC market.
  • Lenovo logoIDC and Gartner concur that Lenovo (LNVGY) is the world’s top PC vendor for 2019. IDC reports Lenovo had a 24.8% global market share and Gartner said it had a  24.1%.
  • Globally HP (HPQ) ranked #2 with 23.9% by IDC and 22.2% by Gartner.
  • Dell was ranked #3 worldwide with 17.4% by IDC and 16.8% by Gartner. Dell’s unit sales climbing by nearly 11%, according to IDC’s estimates.

In the U.S. market the ‘Q4-19 rankings differed:

  • HP logoHP is #1 with a 31.2% market share and a modest 4.4% bump in U.S PC sales for the quarter.
  • Dell ranked #2 with a 26.8% market share and a gain of 15.9% for the period.
  • Lenovo came in #3 with a 14.9% share and 11.2% increase in share.

The tech prognosticators attributed the surge in sales to firms swapping their hardware to Windows ahead of MSFT”s Windows 7 end of support, giving new PC sales a one-time shot in the arm. Ryan Reith, program vice president with IDC’s Worldwide Mobile Device Trackers, said in a statement.

The market will still have its challenges ahead, but this year was a clear sign that PC demand is still there despite the continued insurgence of emerging form factors and the demand for mobile computing.

Ranjit Atwal, a research senior director at Gartner, in a statement to PCWorld, cast doubt on future growth. He says,

The PC market’s future is unpredictable because there will not be a Windows 11. Instead, Windows 10 will be upgraded systematically through regular updates …As a result, peaks in PC hardware upgrade cycles driven by an entire Windows OS upgrade will end.

rb-

Don’t do your happy dance just yet.

Gartner and IDC both predict global sales to steadily decline again over 2020 as MSFT’s drives to a subscription-based model. Other threats to the PC market include:

China – The Chinese government has ordered all PC hardware and operating systems imported from foreign countries to be replaced in the next three years.

HP- Xerox – I have covered Xerox’s maneuvers to take over HP. The possible disruption to HP by a Xerox hostile takeover could rattle the entire sector. Especially if Acer or Asus cannot scale up fast enough.

History – Data from Statista says that annual PC sales have dropped nearly 1/3 from their peak in 2011.

Year# of PC's Change YoY
2011364.0-
2012349.3-14.7
2013315.1-34.2
2014308.3-6.8
2015275.8-32.5
2016260.2-15.6
2017259.6-0.6
2018258.5-1.1
2019261.02.5
2020 *254.3-6.7
Data from Statista YoY = Year over Year in millions of units

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

ATM Jackpotting

ATM JackpottingThe U.S. Secret Service has warned (PDF) financial institutions of logical (jackpot) attacks on Automated Teller Machines (ATMs). These ATM attacks originated in Mexico and have spread to the US. These jackpotting attacks are an industry-wide issue and as one vendor stated, are “a call to action to take appropriate steps to protect their ATMs against these forms of attack and mitigate any consequences.”

The attack mode involves a series of steps to defeat the ATM’s existing security mechanisms and the authorization process for setting the communication within the ATM. Internal communications are used when computer components like the mainboard or the hard disk have to be exchanged for legitimate reasons.

Description of an ATM attack

Automated Teller Machines (ATMs)In a Jackpotting attack, the criminal gains access to the internal infrastructure of the terminal to infect the ATM PC or by completely exchanging the hard disk (HDD). There are a number of steps the attacker has to take for this type of attack:

  1. The top of the ATM must be opened.
  2. The original hard disk of the ATM is removed and replaced by another hard disk, which the attackers have loaded with an unauthorized and/or stolen image of ATM platform software.
  3. In order to pair this new hard drive with the dispenser, the dispenser communication needs to be reset, which is only allowed when the safe door is open. A cable in the ATM is unplugged to fool the machine into allowing the crooks to add their bogus hard drive to the ATM.
  4. A dedicated button inside the safe needs to be pressed and held to start the dispenser communication. The crooks insert an extension into existing gaps next to the presenter to depress the button. CCTV footage has shown that criminals use an industrial endoscope to complete the taskATM's

In other Jackpotting attacks, portions of a third-party multi-vendor application software stack to drive ATM components are used. Brian Krebs at Krebs on Security reports that Secret Service issued a warning that organized criminal gangs have been attacking stand-alone ATMs in the United States using “Ploutus.D,” an advanced strain of jackpotting malware first spotted in 2013.

Mr. Krebs also reports that “During previous attacks, fraudsters dressed as ATM technicians and attached a laptop computer with a mirror image of the ATMs operating system along with a mobile device to the targeted ATM. Once this is complete, fraudsters own the ATM and it will appear Out of Service to potential customers according to the confidential Secret Service alert. At this point, the crook(s) installing the malware will contact co-conspirators who can remotely control the ATMs and force the machines to dispense cash.

In previous Ploutus.D attacks, the ATM Dispensed at a rate of 40 bills every 23 secondscontinuously dispensed at a rate of 40 bills every 23 seconds,” the alert continues. Once the dispense cycle starts, the only way to stop it is to press cancel on the keypad. Otherwise, the machine is completely emptied of cash, according to the alert. While there are some risks of the money mule being caught by cameras, the speed in which the operation is carried out minimizes the mule’s risk.”

Specific Guidance and Recommendations

The most common forms of logical attack against ATMs are “Black Box” and “Offline Malware”. The steps to minimize the risks to ATMs are the same as any other enterprise device.

  1. Make sure firmware and software are current with the latest updates, are important protections to mitigate the impact of Black Box attacks. Four out of five cash machines still run Win XP or Win XP Embedded. The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to at least Windows 7 to defeat this specific type of attack.
  2. Use secure hard drive encryption protections against Offline Malware
  3. Use a secure BIOS remote control app to lock the ATM BIOS configuration and protect the configuration with a password.
  4. Deploying an application whitelisting solution.
  5. Limit Physical Access to the ATM:
    • Use appropriate locking mechanisms to secure the head compartment of the ATM.
    • Control access to areas used by staff to service the ATM.
    • Implement two-factor authentication (2FA) controls for service technicians.
  6. Set up secure monitoring
  7. Use the most secure configuration of encrypted communications. In cases where the complete hard disk is being exchanged, encrypted communications between ATM PC and dispenser protect against the attack.
    • Ensure proper hardening and real-time monitoring of security-relevant hardware and software events.
    • Investigate suspicious activities like deviating or non-consistent transaction or event patterns, which are caused by an interrupted connection to the dispenser. Monitor unexpected opening of the top hat compartment of the ATM.

rb-

Followers of the Bach Seat know how to secure their PCs, I have written about securing PCs many times here. So the question is why not ATMs? Research says that consumers go into the branch less every year. The experts say that by 2022 customers will visit a branch only 4 times a year. In many cases, ATMs are the bank’s surrogates for most cash transactions. It makes sense to get it right.

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Windows Terrible, Horrible, No Good Month

Windows Terrible, Horrible, No Good MonthRedmond’s Terrible, Horrible, No Good, Very Bad month continues. The WannaCry ransomware hit mostly Windows 7 machines, and now researchers from the Russian information security company Aladdin RD recently discovered a new bug that will slow down and crash Microsoft (MSFT) Windows Vista, Windows 7, and Windows 8 PCs, but does not seem to impact Windows 10 so far.

Microsoft logoIn a throwback to the Windows 95 and 98 era, Ars Technica reports that certain specially crafted filenames could make the operating system lock up or occasionally crash with a blue screen of death. Ars reports that the bug allows a malicious website to try to load an image file with the “$MFT” name in the directory path. Windows uses “$MFT” for special metadata files that are used by the NTFS file system. The effected systems do not handle this directory name correctly.

The file exists in the root directory of each NTFS volume, but the NTFS driver handles it in special ways. Ars explains that it’s hidden from view and inaccessible to most software. Attempts to open the file are normally blocked, but if the filename is used as if it were a directory name—for example, trying to open the file c:\$MFT\123—then the NTFS driver takes out a lock on the file and never releases it. Every subsequent operation sits around waiting for the lock to be released. Forever. This blocks all other attempts to get access to the file system, and so every program will start to hang, rendering the machine unusable until it is rebooted.

DDoSArs says that web pages that use the bad filename in an image source will provoke the bug and make the machine stop responding. Depending on what the machine is doing concurrently, it will sometimes blue screen. Either way, you’re going to need to reboot it to recover. Some browsers will block attempts to access these local resources, but Internet Explorer will try to open the bad file.

Ars couldn’t immediately cause the same thing to occur remotely (by sending IIS a request for a bad filename), but it wouldn’t immediately surprise us if certain configurations or trickery were enough to cause the same problem.

Windows Blue Screen of DeathThe Verge has successfully tested the bug on a Windows 7 PC with the default Internet Explorer browser. Using a filename with “c:\$MFT\123” in a website image, their test caused a machine to slow down to the point they had to reboot to get the PC working again.

A Microsoft spokesperson told Engadget that the company is looking into the matter and will give an update as soon as it can.
“Our engineers are currently reviewing the information. Microsoft has a customer commitment to investigate reported security issues and provide updates as soon as possible.”

The Redmond boys also had to release an emergency out-of-band update for the Malware Protection Engine aka Windows Defender. Two Google security researchers discovered the “crazy bad” flaw. They claimed it was “the worst Windows remote code exec in recent memory.” The TechNet article says the vulnerability they patched would allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file (CVE-2017-0290). To MSFT’s credit, they did fix the bug and release the patch with a week of being notified.

rb-

Early reports are that this bug is an attack vector. However, this is a denial of service attack that will need a reboot. This new flaw could be bundled with other more dangerous malware to force the user to reboot allowing the attacking malware to get loaded.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Windows 7 Reaches Middle Age

Windows 7 Reaches Middle AgeNow that you have almost eliminated Microsoft (MSFT) Windows XP from your network and settled on Windows 7 it should be time to catch your breath. But NOOO!! Windows 7 has reached the end of mainstream support.  That’s right we are already 5 years into the Windows 7 era. Repeat after me… Windows 7 still has five years left … Windows 7 still has five years left … Windows 7 still has five years left.

MMicrosoft Windows 7 logoicrosoft commits to 10 years of security fixes and 5 years of feature enhancements and bug fixes for each major OS release. Windows 7 has moved from mainstream support – free help for everyone – to extended support, which means Microsoft will charge for help with the software. That will end in 2020 when Microsoft turns out the lights on Windows 7 for good.

The recent techno-flops from the boys and girls in Redmond, Vista, and Windows 8 have taught enterprises to plan for a new desktop OS every other release. This puts businesses in a bind. MSFT’s track record prevents forward-looking firms from organically growing their desktop fleet into the next cycle. There are those that argue that until Microsoft separates consumer from commercial desktops, Microsoft commercial customers will continue to skip one or more iterations of Windows, their only real answer to the high costs and disruption of upgrading.

Gregg KeizerMirosoft update cycle at ComputerWorld cites research from Gartner (IT) which prognosticates that many enterprises cannot change their processes. Many organizations will go through the same machinations they did with XP. Or maybe even balk at dumping Windows 7 at the same pace as the venerable Windows XP, making things worse. Michael Silver of Gartner told ComputerWorld that having a plan could help organizations avoid a repeat of XP’s expensive end-of-support scramble. Gartner believes that the same EOL mad-scramble we saw with XP will occur again when time is up on Windows 7. Mr. Silver claims:

[A repeat of Windows XP] is certainly likely to happen … One of the big differences that’s been under-considered is that because Vista took five years to come out [after XP], there were eight years between XP and Windows 7. So Windows XP felt pretty old. … Windows 7 won’t feel that old to people…” 

Microsoft Windows 10 logoMr. Keizer argues that the failure of Windows 8 to win enterprise hearts and minds has created an oddity: Even though Windows 7 has made middle age, Microsoft continues to let OEMs sell PCs running the Windows 7 business edition.  Microsoft has yet to name an end date for OEM sales of machines powered by Windows 7 Professional. But because it has promised a 12-month notice, those PCs can still be sold at least until early January 2016, when the OS has but four years of life left.

But if you are just finishing your last migration, then you don’t have all that much time to start planning the next one.

rb-

If you don’t like the Redmond hamster wheel, consider your alternatives. Sophos compares the Windows upgrade schedule to some other options. 10 years might be the best option out there. For example:

  • Apple’s (AAPL) OS X is supported for mystery years,
  • Apple’s mobile iOS is supported for mystery years (3?)
  • Android seems to leave it up to you, but don’t expect Google (GOOG) to commit to securing it.
  • Ubuntu LTS is supported for around 5 years, and
  • Red Hat Enterprise 13 years (with extended support).
Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Millions of PC’s Still Have Stuxnet Bug

Millions of PC's Still Have Stuxnet BugLately, I have covered a few pieces of old IT business here, here, and here. And here is another piece of old business from Infosecurity Magazine. Tara Seals at Infosecurity Magazine recently pointed out new research from Kaspersky. They are reporting that there are 10’s of millions of systems that are still vulnerable to the most infamous malware families that enabled Stuxnet.

Patched in late 2010

RadarResearch by Kaspersky has found the vulnerability that allowed Stuxnet, Flame, and Gauss malware campaigns (CVE-2010-2568) is still being exploited. They are still being exploited despite the flaw having been patched in late 2010 by Microsoft. Kaspersky Lab reported more than 50 million detections on more than 19 million computers worldwide in the past eight months.

The lack of patching by IT administrators is surprising given that the vulnerability has an infamous history. The author explains that the vulnerability is an error in processing tags in Microsoft (MSFT) Windows OS. The flaw enabled the download of the random dynamic library without the user’s awareness. The vulnerability affects Windows XP, Vista, and Windows 7, as well as Windows Server 2003 and 2008.

Sality worm

MalwareThe first malware exploiting this vulnerability appeared in July 2010: the worm Sality. Sality generated vulnerable tags and distributed them through the LAN. Ms. Seals writes that if a user opens a folder containing one of these vulnerable tags, a malicious program immediately begins to launch. The summer of 2010 then saw the appearance of Stuxnet. Stuxnet is a computer worm that was specifically designed (likely by the US and Israel) to sabotage the uranium enrichment process at several factories in Iran. Subsequently, the state-sponsored Flame and Gauss spyware made use of the security hole.

Windows XP vulnerable to Stuxnet

Infosecurity Magazine dug into the statistics and found that most of the unpatched systems were running Microsoft’s outdated Windows XP. Kaspersky said the report.

Knife in the toasterThe lion’s share of detection’s (64.19%) registered .. involved XP and only 27.99% were on Windows 7 … Kaspersky Lab products protecting Windows Server 2003 and 2008 also regularly report detection of these exploits (3.99% and 1.58% detection’s respectively)

Kaspersky data suggests that the problem is self-inflicted.

The large number of detection’s coming from XP users suggests that most of these computers either don’t have an installed security solution or use a vulnerable version of Windows – or both.

Kaspersky also analyzed the geographical distribution of CVE-2010-2568 detections. According to Infosecurity, the top nations with the vulnerability were:

  1. Vietnam (42.45%)
  2. India (11.7%) and
  3. Algeria (5.52%)

Kaspersky researchers told the author, “So many users of outdated versions of Windows mean these exploits are effective even though almost four years have passed since the disclosure and patching of the vulnerability.”

rb-

C’mon, if you are going to use an orphaned operating system, update it as far as you can and get off it as fast as possible.

As Kaspersky pointed out, using an outdated version of an operating system is fraught with the risk of cyber-attacks involving exploits, special programs that target vulnerabilities in legitimate software to infect a computer with other dangerous malware.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.