So my buddy gets his computer broken into (not hacked - the attacker wasn't that capable) by someone we'll call The Bad Guy. The Bad Guy got a keystroke logger somewhere and sent it to my buddy as an email attachment, which was opened in Outlook (see alternative app/OS suggestions below). Then the Bad Guy spends the next three or four weeks getting info from the logger, collecting passwords, user names, account names and such. Then the Bad Guy hits my buddy all at once (probably during hours when my buddy was known to be off shift and sleeping). My buddy's websites are trashed, his email accounts are hijacked and deleted, and many subscriptions and memberships were cancelled since the attacker could now pose as the membership-holder.
If we leave out online banking fraud (which apparently has not occurred), this situation would be about as bad as it gets. Let's make a list of everything that the victim now has to do to pick up the pieces of his online presence and certain aspects of his personal life.
0. Obtain a different, non-compromised computer.
1. Set up new personal and business email accounts (probably at a paid provider as opposed to at some free service), then inform important contacts via telephone or web forms on their sites.
2. Set up new Facebook, MySpace, LinkdIn, Classmates.com or whatever pages and rebuild all contacts lists.
3. Find account numbers, financial transaction records or bills that prove my buddy's identity to the website hosting company. Re-establish access to the website and rebuild it from scratch (all files deleted and replaced by garbage).
4. Image the hard drive of the compromised computer for later reference and/or legal action if desired and possible. Wipe the compromised computer and rebuild from backups, from OS/driver CDs/DVDs if such exist, or by paying the computer maker or authorized repair place to do it.
5. Bring back all personally created documents and work from backups if such were done. Bring back all application programs from install CDs if possessed.
My readers know me as a Linux guy and will anticipate certain suggestions of mine, but let me think like a Windows guy for a bit. I'm confident that I can do this, and am motivated to do so since many of my colleagues spend most of their time in that world. Now, if I'm a Windows person, I would still need to change my ways somewhat. Let's see how adaptation is possible. My buddy is like most people in that he's only concerned with the work that he needs a computer to do, not with security issues on the machine itself. That's how the problem starts and here's a proposed new strategy:
1. Use the original desktop or laptop as the general use/everyday/casual computer. Get another computer for important stuff. And consider a third one, properly Frankensteined for gaming (let's be realistic here).
2. On the general use computer (and the other ones if they're Windows boxes) load an antivirus product like Norton, McAfee, free AVG or such. Load an anti-crapware product like Malwarebytes, AdAware or such. Load a third party cleanup program like Window Washer or the free CCleaner.
3. Update and manually run on a minimum weekly basis all of the programs I mentioned above. In many senses these programs are not automatic; they have to be operated by the user. Various automatic settings are sometimes included but when viruses are automatically found, they must then be deleted by user action (usually prompted by instructions that pop up - they're easy - follow them!) Windows Update also prompts you. Do all updates - they're free bugfixes and don't take much time.
4. If any of these antivirus or anti-crapware products find anything, get onto the other (Important Stuff) computer and see if you can still get into your accounts. If so, change the passwords, going down a roster of accounts that you've stashed for just such an emergency. You may not be acting in time unless you only log onto important stuff with the Important Stuff computer.
5. OPTIONAL - If you wish to investigate, keep the compromised computer in its compromised condition to be examined or for the hard drive to be copied (imaged) for future reference.
6. Rebuild the compromised computer from operating system and driver CDs/DVDs that you've archived in advance, either from the computer purchase or some backup scheme like Norton Ghost or a competitor of that product, or one of the Windows open source (free) backup products.
7. Consider making the Important Stuff computer an Apple Macintosh, or loading a box up with an easy Linux system like openSuse or Linux Mint, which is now available for free, fast download at
LINUXMINT.COM
You knew that was coming.
I understand that if you require Windows for work files or development, then you might not have the open source option. But just about anything web-based is child's play for a *NIX box. And the two Linux distributions I mentioned above have good, bright update indicators on their desktops (updates are how most security holes are dealt with in Linux) that'll make you pretty safe. Unless you've pissed off the Defense Intelligence Agency or the Russian mafia.
Thursday, December 1, 2011
Friday, September 30, 2011
Book Review: THE CUCKOO'S EGG by Clifford Stoll
It's the Reagan administration and although your government research job is unrelated to computer desktop and network maintenance, you've had several such duties deposited into your lap, which became several more. Now you're responsible for solving a summation problem in the accounting program that charges other departments for using time on your system (remember the earliest incarnations of 'time sharing'?). The issue is that there's a bit of time that's been used and no one's paid for it. Digging into the relevant sessions, you notice an account that's been used recently, but was set up for someone who departed for another job two years ago. Questioning of that person and others around him or her deletes the original owner from suspicion. You begin attempting to find out how the current user of that account figured out how to use it - and from where...
Clifford Stoll's classic story of involvement in serious espionage messes begins in this massively plausible way. It was recommended to me by an NT-era MCSE; I proceeded to enjoy the book in spite of myself. But although I'd heard from various (inaccurate) sources that it involved "viruses", I was at least a little surprised to read the following lines early in the story:
echo -n "WELCOME TO THE LBL UNIX-4 COMPUTER"
echo -n "PLEASE LOG IN NOW"
echo -n "LOGIN:"
read account_name
echo -n "ENTER YOUR PASSWORD:"
(stty -echo; \
read password; \
stty echo;\
echo "";\
echo $account_name $password >> /tmp/.pub)
echo "SORRY, TRY AGAIN."
This isn't a random vandalism attempt and not a program that's attempting to replicate over adjacent machines. Somewhat obviously, it's a password grabber that appends the grabbed string to a file and then allows the user to proceed to the real logger-inner. It's a purpose-built program to harvest logins for the sneak thief that's arrogated control of an old account to him, her or its self. It was placed there by whoever broke and entered.
Stoll made the commendable decision not to interfere with the sneak, but to observe the sneak's actions over time. Time revealed that although root was attained, backdoors were installed and files were read, not much time was spent actually reading the files. The sneak proceeded over the LAN to other computers and did the same. The sneak wasn't so much interested in the data (which was downloaded by him) but in the network - the connections over which he could travel to other destinations. And they weren't just unclassified science projects like Stoll's astronomy research post; they mostly included sensitive stuff. Stoll began consulting with the three-letter agencies and the plot thickened.
What follows is not only a story of network research in the days before the consumer internet (which is not a terribly large part of the story) but a common litany of woes regarding having to deal not only with spooks that aren't at liberty to say whether you're full of baloney or not, but with layers and layers of middle management that have no power to say 'yes', but plenty to say 'no'. Without giving much away, I'll say that Stoll laboriously traces the sneak out of the building, out of the organization, away from the West coast to New Jersey, over the transatlantic cable and, modem by modem (that's Modulator/DeModulator, junior) into a situation that begins to address diplomatic issues among countries both allied to us and... perhaps not.
There would be many morals here. The first one that occurs to me is not to let responsibility creep get you thrown into prison, let alone rooked out of a fair paycheck. Five stars out of four.
Clifford Stoll's classic story of involvement in serious espionage messes begins in this massively plausible way. It was recommended to me by an NT-era MCSE; I proceeded to enjoy the book in spite of myself. But although I'd heard from various (inaccurate) sources that it involved "viruses", I was at least a little surprised to read the following lines early in the story:
echo -n "WELCOME TO THE LBL UNIX-4 COMPUTER"
echo -n "PLEASE LOG IN NOW"
echo -n "LOGIN:"
read account_name
echo -n "ENTER YOUR PASSWORD:"
(stty -echo; \
read password; \
stty echo;\
echo "";\
echo $account_name $password >> /tmp/.pub)
echo "SORRY, TRY AGAIN."
This isn't a random vandalism attempt and not a program that's attempting to replicate over adjacent machines. Somewhat obviously, it's a password grabber that appends the grabbed string to a file and then allows the user to proceed to the real logger-inner. It's a purpose-built program to harvest logins for the sneak thief that's arrogated control of an old account to him, her or its self. It was placed there by whoever broke and entered.
Stoll made the commendable decision not to interfere with the sneak, but to observe the sneak's actions over time. Time revealed that although root was attained, backdoors were installed and files were read, not much time was spent actually reading the files. The sneak proceeded over the LAN to other computers and did the same. The sneak wasn't so much interested in the data (which was downloaded by him) but in the network - the connections over which he could travel to other destinations. And they weren't just unclassified science projects like Stoll's astronomy research post; they mostly included sensitive stuff. Stoll began consulting with the three-letter agencies and the plot thickened.
What follows is not only a story of network research in the days before the consumer internet (which is not a terribly large part of the story) but a common litany of woes regarding having to deal not only with spooks that aren't at liberty to say whether you're full of baloney or not, but with layers and layers of middle management that have no power to say 'yes', but plenty to say 'no'. Without giving much away, I'll say that Stoll laboriously traces the sneak out of the building, out of the organization, away from the West coast to New Jersey, over the transatlantic cable and, modem by modem (that's Modulator/DeModulator, junior) into a situation that begins to address diplomatic issues among countries both allied to us and... perhaps not.
There would be many morals here. The first one that occurs to me is not to let responsibility creep get you thrown into prison, let alone rooked out of a fair paycheck. Five stars out of four.
Wednesday, June 8, 2011
Here's a quote...
...that may express some of my thoughts on programming and on Linux well:
“It is not the strongest of the species that survives, nor the most intelligent that survives. It is the one that is the most adaptable to change.”
- Charles Darwin
“It is not the strongest of the species that survives, nor the most intelligent that survives. It is the one that is the most adaptable to change.”
- Charles Darwin
Sunday, June 5, 2011
Linux Links
Here's some of my favorite links on a favorite subject...
TRINITY RESCUE KIT -
A distribution specifically geared to repairing Windows installs.
DISTRO WATCH -
Follows new releases and updates of old standards.
LINUX QUESTIONS -
Volunteer organization that answers quandries and categorizes them for others to reference
CLONEZILLA -
a distribution recently noted in Linux Journal for effectiveness in backup and mass rollouts
LINUX JOURNAL -
A most valuable authority with a helpful website as well
BACKTRACK LINUX -
A distribution full of tools for penetration testing and data recovery, etc. etc.
FROZEN BUBBLE -
The only game you'll ever need!
TRINITY RESCUE KIT -
A distribution specifically geared to repairing Windows installs.
DISTRO WATCH -
Follows new releases and updates of old standards.
LINUX QUESTIONS -
Volunteer organization that answers quandries and categorizes them for others to reference
CLONEZILLA -
a distribution recently noted in Linux Journal for effectiveness in backup and mass rollouts
LINUX JOURNAL -
A most valuable authority with a helpful website as well
BACKTRACK LINUX -
A distribution full of tools for penetration testing and data recovery, etc. etc.
FROZEN BUBBLE -
The only game you'll ever need!
Thursday, May 12, 2011
Virtualization
The ability to generate software-only instances of an operating system (virtual systems) promises freedom from hardware concerns and an endless amount of no-cost capability, right? Not exactly, but it holds great promise in certain circumstances. Here's my fence-sitting take on the positives and negatives of this new technology.
POSITIVES:
1. Reduced electrical cost (less power supplies to feed)
2. Reduced equipment inventory and space
3. Reduced spare parts inventory and space
4. Simplified rebuild administration (ability to spawn new instances quickly)
NEGATIVES:
1. Heavier hardware requirements for remaining computers
2. Ability to run more systems = greater demands on the admin's time
3. Related to above: possible management denial that virtual machines need attention
4. Related to above: multiplicity of installs may lead to security holes
Reduced cost and space has been the main attention-getter. The more purely electronic and virtual an organization, the less material maintenance is needed on all fronts (not that one could totally get away from it). On the downside, an operation might need newer computers and networking to handle the throughput and ram demands. And responsibility creep might chase away admins who see more systems assigned to them while a manager might be tempted to overrule objections since the new machines (that require configuration, patching, security analysis, monitoring etc. etc.) are "only virtual". And if many instances of disparate OS's are forgotten about after a few rounds of testing, a break-in artist could find abandoned and unpatched opportunities for setting up shop.
I think the obvious conclusion is that whether or not virtualization works is a function of the skill of the administrator(s). To a lesser degree it's a function of whether or not the hardware STILL present can handle the loads. And we should all remember that if more systems are running on fewer devices, then backups (both software and spare turnkey machines) are rendered even more important than they've traditionally been, which is a lot.
POSITIVES:
1. Reduced electrical cost (less power supplies to feed)
2. Reduced equipment inventory and space
3. Reduced spare parts inventory and space
4. Simplified rebuild administration (ability to spawn new instances quickly)
NEGATIVES:
1. Heavier hardware requirements for remaining computers
2. Ability to run more systems = greater demands on the admin's time
3. Related to above: possible management denial that virtual machines need attention
4. Related to above: multiplicity of installs may lead to security holes
Reduced cost and space has been the main attention-getter. The more purely electronic and virtual an organization, the less material maintenance is needed on all fronts (not that one could totally get away from it). On the downside, an operation might need newer computers and networking to handle the throughput and ram demands. And responsibility creep might chase away admins who see more systems assigned to them while a manager might be tempted to overrule objections since the new machines (that require configuration, patching, security analysis, monitoring etc. etc.) are "only virtual". And if many instances of disparate OS's are forgotten about after a few rounds of testing, a break-in artist could find abandoned and unpatched opportunities for setting up shop.
I think the obvious conclusion is that whether or not virtualization works is a function of the skill of the administrator(s). To a lesser degree it's a function of whether or not the hardware STILL present can handle the loads. And we should all remember that if more systems are running on fewer devices, then backups (both software and spare turnkey machines) are rendered even more important than they've traditionally been, which is a lot.
Wednesday, February 16, 2011
Got the call again...
And by that, I mean the call from the Windows User to the Computer Person to fix something undetermined. And she was cute, so one will agree and mentally review the steps involved in hopefully saving the day. It's a 2-yr-old-ish Vista laptop and this time, I'm not just doing updates but expecting the worst in the way of poorly written Russian adverts and so on. I'm picking it up on Thursday but forged ahead by downloading a new build of Trinity Rescue Kit.
TRK 3.4 is a Linux distro with a payload of tools aimed at Windows repair. The star of the show is a command-line version of ClamAV. I'm assuming viruses have set up housekeeping, so I'll give it the full treatment (boot from the TRK cd and go online for latest signatures, then run against HDD for three or four hours). But after that's done, the usual list will kick in:
0. Ideally, do backups as soon as one gets to a stable desktop (hope springs eternal)
1. Disk Cleanup and chkdisk (file integrity check)
2. Defrag
3. update and run the anti-junkware (Spyware Blaster, SuperAntiSpyware or whatever)
4. update and run any onboard brand-name Antivirus (or download AVG or something if there's nothing already there)
5. OS updates
6. browser updates
7. Flash update
8. Acrobat reader update
9. any other app updates available
That's the seat-of-the-pants list. Better lists exist; this one's probably all I'll have time for this week. Unless she's really persuasive.
RESULT: The laptop didn't even boot, so she let me have the carcass for parts and the effort (I got an HDD and some memory out of it) and she went with a new netbook. Good to reacquaint myself with TRK, though.
TRK 3.4 is a Linux distro with a payload of tools aimed at Windows repair. The star of the show is a command-line version of ClamAV. I'm assuming viruses have set up housekeeping, so I'll give it the full treatment (boot from the TRK cd and go online for latest signatures, then run against HDD for three or four hours). But after that's done, the usual list will kick in:
0. Ideally, do backups as soon as one gets to a stable desktop (hope springs eternal)
1. Disk Cleanup and chkdisk (file integrity check)
2. Defrag
3. update and run the anti-junkware (Spyware Blaster, SuperAntiSpyware or whatever)
4. update and run any onboard brand-name Antivirus (or download AVG or something if there's nothing already there)
5. OS updates
6. browser updates
7. Flash update
8. Acrobat reader update
9. any other app updates available
That's the seat-of-the-pants list. Better lists exist; this one's probably all I'll have time for this week. Unless she's really persuasive.
RESULT: The laptop didn't even boot, so she let me have the carcass for parts and the effort (I got an HDD and some memory out of it) and she went with a new netbook. Good to reacquaint myself with TRK, though.
Tuesday, November 2, 2010
Hardware Adventures
I just got a two-year-old off-lease Dell Optiplex GX520 (one of that boxy-looking line of desktops) and when it arrived I prepared to blow away the included build of WinXP for something else, since I already run that system for purely educational purposes and didn't need another instance of it. I got a surprise as I ran the system before erasing it. The DVD-ROM drive didn't work. So how to load a new system onto the box - not to mention finding the solution to the malfunction (assuming no flash drive load or network install)?
This is an important question for the open source community, inveterate OS reloaders that we are. The Optiplex line is huge and it appears to me that there might be a motherboard issue here that will be an issue in Linux loading - but I'm getting ahead of myself. Here's what happened as I examined XP performance and loaded (full disclosure here) Win7. [Again, for educational purposes! You can't criticize if you're not experienced.]
From an educational source I'd gotten the Win7 upgrade disc and it was to load on top of the XP load present on the 520. Remember, XP either didn't have a driver for the DVD-ROM or there was a plain hardware failure (a Dell driver CD was not provided with the purchase). I proceeded with the Win7 loading by using a USB outboard DVD burner (with proper BIOS setting for boot-from-disc) and then did the updates. The original inboard DVD-ROM still didn't work after a few reboots.
But after a few MORE reboots and the phone ringing in the other room, I returned to see a word balloon in the bottom right corner of the screen announcing a driver update from somewhere (presumably Windows/MS Update). I allowed it and the inboard transport instantly worked.
If a particular piece of software is needed for the box to see and run the ROM drive, this may indicate a need for the open source OS's to be amended accordingly. On the other hand, maybe there exists in the Linux, BSD and/or OSX worlds a generic driver that works just fine. I don't know. What I do know experimentally is that Win7 eventually recognized and updated the issue itself, without my consulting the Dell site for drivers... which I might still need to do for other issues.
I don't recommend staying away from Optiplexes. I'm just putting this your-mileage-may-vary note out there. It's very possible that the problem has already been solved by all concerned parties and there really aren't any reloading problems here. I'm just surprised that Win7 either knew what to do or figured it out. I hereby grudgingly give credit where credit is due.
(Update of 11/8)
So the driver still appears, goes away and then reappears. But the cause is now known. I looked up the Optiplex model on Dell's support site and it turns out that there is no official Windows 7 driver for this model's transport - but that doesn't keep Windows Update from trying. So I'll just continue to use the outboard unit for burning and trust in some programmer in Austin or somewhere to come through for me eventually...
This is an important question for the open source community, inveterate OS reloaders that we are. The Optiplex line is huge and it appears to me that there might be a motherboard issue here that will be an issue in Linux loading - but I'm getting ahead of myself. Here's what happened as I examined XP performance and loaded (full disclosure here) Win7. [Again, for educational purposes! You can't criticize if you're not experienced.]
From an educational source I'd gotten the Win7 upgrade disc and it was to load on top of the XP load present on the 520. Remember, XP either didn't have a driver for the DVD-ROM or there was a plain hardware failure (a Dell driver CD was not provided with the purchase). I proceeded with the Win7 loading by using a USB outboard DVD burner (with proper BIOS setting for boot-from-disc) and then did the updates. The original inboard DVD-ROM still didn't work after a few reboots.
But after a few MORE reboots and the phone ringing in the other room, I returned to see a word balloon in the bottom right corner of the screen announcing a driver update from somewhere (presumably Windows/MS Update). I allowed it and the inboard transport instantly worked.
If a particular piece of software is needed for the box to see and run the ROM drive, this may indicate a need for the open source OS's to be amended accordingly. On the other hand, maybe there exists in the Linux, BSD and/or OSX worlds a generic driver that works just fine. I don't know. What I do know experimentally is that Win7 eventually recognized and updated the issue itself, without my consulting the Dell site for drivers... which I might still need to do for other issues.
I don't recommend staying away from Optiplexes. I'm just putting this your-mileage-may-vary note out there. It's very possible that the problem has already been solved by all concerned parties and there really aren't any reloading problems here. I'm just surprised that Win7 either knew what to do or figured it out. I hereby grudgingly give credit where credit is due.
(Update of 11/8)
So the driver still appears, goes away and then reappears. But the cause is now known. I looked up the Optiplex model on Dell's support site and it turns out that there is no official Windows 7 driver for this model's transport - but that doesn't keep Windows Update from trying. So I'll just continue to use the outboard unit for burning and trust in some programmer in Austin or somewhere to come through for me eventually...
Subscribe to:
Posts (Atom)