Insider Attacks From Outside the Firewall Written by Gideon J. Lenkey

When times get tough, things change for everyone, and sometimes employees don't like changes that management makes. This can be especially true if the employee is being "laid off." But what about laying off people with specific and valuable knowledge about your business? That's not an easy call, and it's certainly a risk.

While no one likes to hear that their job position has been eliminated or another person will be doing it, some people will take it very personally, and a small subset of those people will actually attempt to take some sort of revenge.

Sometimes the revenge manifests itself as feeling entitled to the work product they produced while at the company -- a customer list or program source code, for instance. Other times it can take the form of sabotage, such as destroying data or rendering critical computer systems inoperative. While ways to cause damage to a company or former employer are limited only by imagination, we'll keep the focus on things that are information-system related.

Recently I investigated a case where a laid-off employee intruded into the corporate network of his former employer from the public Internet and rendered critical computer systems inoperative, which caused serious damage. It wasn't the first time I've seen this, and it won't be the last. What I'd like to share is what you can do in advance that makes investigating such incidents a smaller and more effective effort. A little preparation will also make the effort much cheaper.

While preventing an incident is obviously the ideal, it's not always possible to defend against a motivated attacker with specific knowledge about the internal workings of a company. Also, what if the individual is a privileged user on the network, such as an administrator, or a help desk or tech support operator? This person could potentially have access to other users' account information and may actually be able to make new accounts for the purposes of covert or continued access from the Internet to the corporate network beyond the scope of employment.

By now, most companies have basic protective controls on their networks such as a firewall. If your company is a little more forward-thinking, perhaps you've also already deployed an application proxy. These controls are necessary and good at what they do, which is controlling the network border with the Internet, denying the known bad traffic, and allowing the known good, at least in theory.

Maybe your company also has an IDS (intrusion detection system), which will look for known signs of malware or abuse and send out an alert; or maybe you have an IPS (intrusion prevention system), which will attempt to block it. All of these things are good and necessary. But what happens when Biff from sales gets fired and logs back into the network via the VPN using Brad's (also from sales) password? He knows Brad's password because he sits next to him and saw the Post-It note/heard him on speakerphone with tech support/or simply guessed it (G1ant$rule!).

The problem here is a simple one: Every rule was followed during Biff's termination -- his accounts were deactivated and he was walked out of the building -- but he was still able to remotely log back in to the network, likely with similar privileges as he had in his former position. Despite the company following industry best practices, the firewall, proxy, IDS, VPN, and even the Windows Domain all see this as a legitimate log-in, though it isn't.

So what can you do? How about trace the IP address? Sure -- it's a library gateway for hundreds of branches around the city... Have fun storming the castle!

This sort of access can go on unnoticed for quite some time, depending on the password policy -- and even then if the attacker can install a key logger, it'll just email him the new credentials anyway. Remember, email is legitimate, allowed traffic!

Here are some thoughts on how to manage this sort of risk:

* Make sure you keep all of your VPN, Domain, and Critical server logs on a separate server. The audit function must be also be separate from IT so that compromised Adminstrator accounts cannot delete or manipulate log data.
* Make sure you can make reports on those logs. There are plenty of third-party products that make this easier; I'm sure some of you folks can chime in with your favorites.
* Record and report failed VPN or remote log-in attempts. Recognizing this clue to impending abuse originating from the Internet early on can really save your bacon.
* Single-factor authentication must die! I know I'm preaching to the choir, but two-factor authentication, while certainly not infallible, raises the bar for remote access abuse on a would-be attacker.

Microsoft Word Sales Banned In US In 60 Days

A Judge on Tuesday ordered Microsoft (NSDQ: MSFT) to stop selling its popular Word document creation application in the United States in 60 days, after finding that the software contains technology that violates a patent held by a third party.

Microsoft Office, which includes Word, accounted for more than $3 billion in worldwide sales in Microsoft's most recent fiscal year and is used by literally millions of businesses and consumers for everyday tasks like word processing and making spreadsheets and presentations.

Read the rest of this article at:
http://www.informationweek.com/news/software/enterpriseapps/showArticle.jhtml?articleID=219200383&cid=nl_IW_daily_html

Microsoft Accedes to EU Demands, Setting Bad Precedent By Paul Thurrott

Late last week, Microsoft announced something that virtually no one--myself included--saw coming. Rather than continue with its previous approach to dealing with antitrust regulators from the European Union (EU)--an approach that, frankly, was the technical equivalent of a middle finger lofted in the direction of Brussels--Microsoft said that it would simply accede to the EU's demands. It will allow Windows 7 customers in the EU to choose between competing web browsers via a so-called ballot screen. The company’s previous approach, the Windows 7 E Editions, which simply removed Internet Explorer from Windows 7, was apparently not radical enough.


Check out this article... (the evil empire may be crumbling)
http://ct.email.windowsitpro.com/rd/cts?d=33-70133-793-207-162433-3639221-0-0-0-1-2-207

Kon-Boot Lets You Bypass Logon for Windows and Linux

Kon-Boot looks like a very interesting tool since it can get you into a system without having to logon first.

According to the description at the tool's site, Kon-Boot alters a Linux or Windows kernel on the fly during boot up. The result is that you can login to a system as 'root' or 'administrator' without having to know the associated account password.

The tool reportedly works with Windows Vista, XP, Server 2008, Server 2003, Windows 7, Gentoo, Ubuntu, Debian, and Fedora.

All of you admins out there might want to give this tool a whirl to see how it works against your systems - before one of your users does!

Microsoft, What's Going On? IT Pros and Partners Want to Know By Paul Thurrott

Next week, Microsoft hosts its annual Worldwide Partner Conference in New Orleans, the first time the software giant has returned to that city in a major way since the Katrina debacle (at least to my knowledge). On the face of things, the WPC doesn't sound like it would be a thrilling event per se--images of CEO Steve Ballmer bounding across the stage caterwauling "partners, partners, partners!" notwithstanding--but this show has always offered up some compelling info about Microsoft's upcoming products. This year, on the eve of WPC, however, I have some questions.

Windows 7 and Windows Server 2008 R2
Microsoft previously announced that it would complete development of Windows 7 and Windows Server 2008 R2 in July 2009, so it's likely that the company will reveal that milestone at the show. But numerous questions surround these products, even in the wake of last week's Windows 7 retail pricing announcement.

For example, will businesses be able to get access to these products electronically before the October 22, 2009 launch date? And if not, why? And what about MSDN and TechNet customers?

Indeed, the sheer number of questions swirling around Windows 7 pricing, availability, and various upgrade issues is astonishing, especially when you consider that Microsoft had months to prepare for this event. The company could really clarify things a lot better than it has.

Office 2010/Office Web Applications
Last year at the Professional Developers Conference, Microsoft announced that it would deliver a beta version of its upcoming Office Web Applications (using the now-overloaded OWA acronym, with due respect to Outlook Web Access) by the end of 2008. Now 2009 is nearly half over, and it still hasn't happened.

We can expect a lot of Office 2010 pomp and circumstance at WPC next week, including the release of the previously announced Office 2010 Tech Preview (which leaked to the web over a month ago, by the way). But what about OWA?

GMail Security

Gmail users interested in enabling HTTPS before Google can do so by logging into their Gmail account, then click on the “Settings” tab, scroll to “Browser connection,” and then click on “Always use HTTPS” so the security feature will be enabled.

Yahoo Mail, Microsoft Hotmail, Facebook and MySpace also use HTTPS when logging a user into the service, but don’t have the security feature available once a user is logged in, according to security experts. Normally only sites such as banks and credit card web sites have permanent HTTPS connections, but there is growing pressure for e-mail services and other sites to support HTTPS at other times besides log in.

Windows 7 Mojo

Windows 7 By Paul Thurrott


By Paul Thurrott
Last week, Microsoft announced that Windows 7 and Windows Server 2008 R2 will be released to manufacturing (RTM) in the second half of July and will be made generally available to customers on October 22, 2009. This date is almost exactly one year after Windows 7's public unveiling at Microsoft’s Professional Developers Conference 2008 last October and well before the original timeframe Microsoft had allotted for its release.

As most of you are well aware, I've been evaluating Windows 7 since last year. Actually, maybe "evaluating" isn't the right word: I've been using Windows 7 day to day on all of my production PC hardware, giving up Windows XP and Vista almost entirely, since late 2008. And in this time, I've never run into any major issues, on any of the many, many PCs with which I've used Windows 7. This has been the most uneventful OS beta in Microsoft's history, from what I can tell.

In fact, I'd go so far to say that Windows 7 has brought the NT mojo back to Microsoft's desktop OS, and in a big way. (Side note: The Server team never lost its mojo.) And this is a big deal, as any NT old-timer could tell you.

To view the rest of this article go to:
http://ct.email.windowsitpro.com/rd/cts?d=33-66729-793-12070-162433-3303378-0-0-0-1-2-207

More improvements on "Cloaking"

‘Breakthrough device represents major improvement over past efforts.’ -

For those dreaming that the Star Trek technology of cloaking will one day become reality, they can take note of the steady progress that real-world cloaking technology has been making. The goal of cloaking research is to find ways to redirect light around a shape, from all directions, in essence making it so the shape disappears to the naked eye. Scientists have had success working with nanoscale objects using special lenses.

http://www.insidetech.com/news/articles/4812-simplified-cloaking-tech-can-cloak-bigger-objects

MicroSoft and Linux Finally Agree On something

‘Microsoft, Linux Foundation finally find something they can agree on.’ -

It doesn’t happen often, but Microsoft and the Linux Foundation have issued a joint letter voicing their displeasure over the American Law Institute (ALI)’s latest effort to create an implied warranty stating that all shipped software have no material hidden defects.

The ALI is largely made up of judges and attorneys who are assigned the task of dealing with protocols related to software sales and warranties. Due to serious flaws and other issues, more consumers are interested in having politicians and others deal with defective software, as it can be sometimes difficult to get the companies behind the software to take responsibility.

“Parties should ”http://www.betanews.com/article/Linux-Foundation-joins-Microsoft-in-opposing-software-defect-warranties/1242746153" rel="nofollow">be able to choose the rules that best suit their needs, as they have the most knowledge about their particular transaction," according to the joint letter. “That is not to say that certain protections — for example, in the business-to-consumer context — are not warranted. But even in today’s common law approach to software contracts, there is no great failure in terms of substandard quality or unmet expectations that would justify imposition of new mandatory rules, particularly given existing remedies under misrepresentation and consumer protection law.”

Both the Linux Foundation and Microsoft especially don’t like the following statement written into the ALI’s Principles of the Law of Software Contracts: “A transferor that receives money or a right to payment of a monetary obligation in exchange for the software warrants to any party in the normal chain of distribution that the software contains no material hidden defects of which the transferor was aware at the time of the transfer. This warranty may not be excluded.”

Specifically, Microsoft and Linux Foundation officials want the ALI to clarify that statement, as they believe it’s a bit too vague, while also wanting their attorneys to read over the published principles.

READ MORE...
http://www.insidetech.com/news/articles/4805-ms-linux-foundation-both-oppose-software-defect-warranties

Facebook Phishing

If you've noticed some strange messages arriving on your Facebook account these past couple weeks, one of your friends has been hacked. That's hardly news, but the fact that those hacks are part of a coordinated effort to hit Facebook definitely is. We'll show you what Facebook is doing about it.

Check out this Owl! He looks like a Furby!!

Look at Weirdest Owl In The World...
http://video.msn.com/?mkt=en-us&vid=2a694dab-a29d-4b52-8119-d884b137e523&playlist=videoByUuids:uuids:2acdd4b0-c3e2-4176-a138-9ad4f07503b2%2C3fe5e84c-a540-494d-8a72-f4901fc4e6ba%2Ccb521a52-855d-4b2b-926b-fd1488250072&from=MSNHP&tab=m137>1=42007

Life is good when it's busy...

But I'm too busy to look for an interesting blog. Sorry don't feel like I don't still love ya!

NEAT STUFF!--Go GREEN

"The Vatican is going solar in a big way. The tiny state recently announced that it intends to spend 660 million dollars to create what will effectively be Europe's largest solar power plant. This massive 100 megawatt photovoltaic installation will provide enough energy to make the Vatican the first solar powered nation state in the world! 'The 100 megawatts unleashed by the station will supply about 40,000 households. That will far outstrip demand by Pope Benedict XVI and the 900 inhabitants of the 0.2 square-mile country nestled across Rome's Tiber River. The plant will cover nine times the needs of Vatican Radio, whose transmission tower is strong enough to reach 35 countries including Asia.'"

Is it all worth it?

I may just be in a slum but I have recently had my doubts on whether this past two years was worth the time and investment. I have had no luck finding a job!

I wish the best to all of you!

Ssytem Maintenance Test

Whew! Glad that's over...

10M Worm-Infected PCs Prepare for April 1 Conficker Update

Conficker, the toughest, most virulent worm around has already infected more than 10 million systems. And it's about to get worse. According to security researchers, Conficker will receive an update tomorrow that should make it even harder to eradicate. We've got the latest on the worm's evolution.

http://www.insidetech.com/news/articles/4416-10-m-conficker-worm-infections-prepare-for-april-1-update?referral=IT_nlet_20090331_members

Ultimate Guide How to Replace Lame Windows with Kick Ass Linux

Ultimate Guide How to Replace Lame Windows with Kick Ass Linux

March 23, 2009 at 05:03:04 AM, by Blair Mathis Rating: 3 out of 5

Linux is the upcoming operating system working it's way into the average consumer household. First used by only the geekiest of the geeks, it can now be found on many laptops and desktops at colleges, Linux, once exclusive only to geeks, is now the must-have operating system for the average laptop user.

http://laptoplogic.com/resources/ultimate-guide-how-to-replace-windows-with-linux

Ahh, could it be SATAN?

A woman accused of taking more than $73,000 from the Arlington church where she was an administrative assistant blames the devil. Papers filed with a theft charge Wednesday in Snohomish County Superior Court say the 62-year-old Arlington woman told detectives "Satan had a big part in the theft."

The Everett Herald reported the woman was accused of forging the pastor's signature on 80 checks from the Arlington Free Methodist church. She was fired in February 2008.

She told detectives she used the money to cover household expenses because she couldn't stand the thought of losing her home.

IHRA Races

Well, we qualified 4th out of 32 however on the first bracket race Audey went to hit the starter button and it fell out of the bracket. We were disqualified because you can't work on your car at the starting line. Oh well, we had'em worried in the qualifying rounds! Better luck next time....in two weeks!

My new puppy

I got a new puppy, she runs from the kitchen to the bean bag and jumps on like superdog. So funny!

The WEATHER #@*%!!

I don't know what's up but it is making me sick!!!

If you think the recession is bad - just think what we are doing to our planet and it's climate these days!

CSS Help!

I need to style an ul tag with bullets that are replaced with an image. I have an id="school_list" on this one ul tag that is not on the index.htm page but on another page. I want to replace the bullets with an image only on the this one ul tag and none of the others (thus the id="school_list).
1. How do I access this one ul tag that is contained n a div id="content" / ul tag id="school_list" in the default.css file?

2. How do I replace the bullets with an image?

This is what I have that doesn't work:

#school_list ul{
list-style-image: url('abc.gif')
}

I have also tried:
div#content #school_list ul{
list-style-image: url('abc.gif')
}
AND
ul.school_list {
list-style-image: url('abc.gif')
}

Waiting for advice.......

I was discussing with a friend how a scientist has a theory about how matter never really goes away -it just changes form. Take for instance a black hole, the common misconception is that matter goes into a black hole and disappears forever, the scientist new theory is that it just passes through to another galaxy or universe. In a time of great loss to me this is somehow very comforting. Take a look at this article from CNN today:

Galaxy may be full of 'Earths,' alien life

As NASA prepares to hunt for Earth-like planets in our corner of the Milky Way galaxy, there's new buzz that "Star Trek's" vision of a universe full of life may not be that far-fetched. There may be 100 billion Earth-like planets in the Milky Way, or one for every sun-type star in the galaxy, said Alan Boss, an astronomer with the Carnegie Institution and author of a new book. full story

The Death of the Bit Torrent?

If Pirate Bay goes down for the count, could it take all of BitTorrent with it?

The people who run the massive BitTorrent site Pirate Bay (thepiratebay.org) are going on trial for copyright violations next week in Stockholm, Sweden.

BitTorrent is a popular peer-to-peer file sharing protocol which is widely used to share large media files like television shows, movies and music.

TorrentFreak has an interesting article which quotes Raynor Vliegendhart of the Tribler P2P team at Delft University of Technology, who believes that the Pirate Bay’s servers support as much as 50 percent of all the BitTorrent traffic on the Internet.

So the general belief is if they go down for any extended time — or, God forbid, permanently — it could have a huge impact on torrenters everywhere, including leading to the failure of other trackers (sites that coordinate the sharing process) due to overload.

As always, can’t wait to hear what you, our valued viewers, have to say on this topic.

Microsoft Offers $250K to Catch Worm Authors

MS Offers $250K to Catch Worm Authors
With the Confisker worm still running wild, tech companies are turning to some desperate measures. Microsoft just offered $250,000 to anyone who would help turn over the worm's authors. Find out why Confisker is so hard to kill and why MS decided to offer a reward.

Ethernet zooms to 100 GB speeds

http://gigaom.com/2006/11/14/100gbe/
says...
How fast can data travel over Ethernet? If you answered 10 Gigabit per second, then you would be off by about 90 gigabits per second. Infinera, a San Jose, Calif.-based start-up, along with University of California, Santa Cruz, Internet2 and Level3 Communications, today demonstrated a 100 gigabit/second Ethernet connection that could carry data over a 4000 kilometer fiber network. The trial took place at the Super Computing Show in Tampa, Florida.

The future of newspapers?

There’s been a lot of chatter about the newspaper industry in recent weeks about whether newspaper companies should find something like iTunes , or use micropayments as a way to charge people for the news, or sue Google , or all of the above and how journalism is at risk because newspapers are dying. Who thinks Newspapers should go the way of dot matirx printer?

Captains Log - Stardate - Wednesday Feb 04, 2009

No unusual sitings today. So far things are a go as normal. A few characters have appeared but have been relatively peaceful and un-annoying. Hopefully the cosmos will stay in my favor through the weekend.

BTW - I saw on the web where scientists are working on teleporting atoms! Beam me up Scotty!

Send me some URL's to you guys blogs so we can chat about stuff!

What do you want to talk about?

I'm not that much of a blogger. I usually just send e-mails to a select few people. I'm sure you guys can get this thing rolling better than I. Send me some stuff to discuss. What do you want to talk about?