CoNetrix

Blog

I went to visit family this past weekend and as the family’s ambassador for technology, I was set to work on their list of electronic aches and pains. My aunt who recently upgraded her abacus-era computer for a new PC was complaining that whenever she would plug her computer into the phone line, all incoming phone calls would chirp once on the house phones, then nothing. She had already talked to the techno-wizards at Radio-Shack who said that she probably had “older 3-wire phone wiring that might not work with her new computer”. I had to bite my tongue. [more]

After some fact finding investigation, it appeared that the house was wired in a loop (not star) configuration. Also, it didn’t matter what phone jack the computer was connected to, the results were still the same single “chirp”. At first I thought the PC might be using some telephony software to try and answer the call, but the behavior remained the same with the system powered off and unplugged from power (but w/ the phone line still connected to it). With her phone line connected to my laptop, incoming calls rang fine.

Adding up all of these factors pointed to a bad PCI modem installed in the computer. My hypothesis is that somewhere in the manufacturing process a path to a capacitor or resistor got messed up so that when the phone rang, the current charged the capacitor thus completing the circuit and dropping the incoming call. The moral of the story… just because something is new and has a manufacturing defect rate of 10,000:1 doesn’t mean you can’t be that one person. Now if I could only get that lucky in the lottery…(oh wait, that would mean I have to actually play it).

General, Dial-up,
 

G-Archiver, a shareware application used to backup Gmail accounts, was reported to be storing usernames and passwords. [more]

Jeff Atwood reports that he received the following "hair-raising tale" from Dustin Brooks via e-mail:

"I was looking for a way to back up my gmail account to a local drive. I've accumulated a mass of important information that I would rather not lose. During my search I came across G-Archiver, I figured what the heck I'll give it a try.
It didn't really have the functionality I was looking for, but being a programmer myself I used Reflector to take a peek at the source code. What I came across was quite shocking. John Terry, the apparent creator, hard coded his username and password to his gmail account in source code. All right, not the smartest thing in the world to do, but then I noticed that every time a user adds their account to the program to back up their data, it sends and email with their username and password to his personal email box! Having just entered my own information I became concerned.
I opened up a browser and logged in to gmail using his account information. It still worked.
Upon getting to the inbox I was greeted with 1,777 emails with account information for everyone who had ever used the software and right at the top was mine. I decided to go ahead and blast every email to the deleted folder and then empty it. I may have accidentally changed the password and security question to something I don't remember as well, whoops, my bad. I also contacted google to erase this account as I didn't see a way to delete it myself."

For more details, visit http://www.codinghorror.com/blog/archives/001072.html or http://www.informationweek.com/news/showArticle.jhtml?articleID=206902839

This is a perfect example of why end users need to be very conscious of what they install, and why companies need to have adequate policies and procedures related to the installation and use of software.  As we have said in our company before, "Paranoia is not necessarily a bad thing"

Security and Compliance, Google, Gmail, G-Archiver, Security, backup,
 
 

29A is a notorious virus "research" group, with member such as Benny, VirusBuster, Super, ValleZ who were prominent in the virus-writing circles. This group published a virus magazine in order to spread the know how to create viruses. Over the past few years, the group has steadily lost members.  One of the last remaining members, VirusBuster, posted what looks to be the last message: "29A has left the building!"  For more information, go to http://www.securityfocus.com/blogs/655

Security and Compliance, Virus,
 
 

I was researching a way to do major router changes remotely.  I found that if I tftp’ed a new configuration directly to NVRAM and replaced the startup-config file, then reloaded the router, all changes would go into effect.  While testing this process locally, I found out that when the router was reloaded with the new configuration file, the SSH encryption keys got erased and had to be regenerated.  So if this process is used, make sure telnet is enabled on the VTY lines so that you can get back into the router!

Networking, Cisco, Router, Encryption, SSH,
 

With 3 sons at home, the dangers posed by the dark side of the Internet are a real concern. During a recent visit to Kim Komando’s website, I discovered a totally FREE Internet filtering and control solution for the home called K9 Web Protection. After testing it on two of our three systems at home for about 10 days, it appears to be as effective and custom configurable as other commercial products I have used in the past.[more]

K9 Web Protection (http://www1.k9webprotection.com/) is protecting almost half a million homes, according to their website, and has been awarded the Seal of Approval from The National Parenting Center (http://www.tnpc.com/search/tnpcarticle2.asp?rec=5275), the iParenting Media Award (http://iparentingmediaawards.com/winners/11/5572-4-174.php) and the IIA Family Friendly Filter (http://www.iia.net.au/index.php?option=com_content&task=view&id=416&Itemid=73). Additionally, CNET’s Editor Rating is 4 stars (of 5) and the average rating from CNET users is 4½ stars (see http://www.download.com/K9-Web-Protection/3000-2162_4-10487710.html?tag=lst-6-4).

I was also impressed with the philosophy that led Blue Coat Systems to offer this product free for home use:“Blue Coat Systems has been very successful selling a version of this software to Fortune 500 companies and other large corporations. When we became successful, and were looking for ways to give back to our communities, we realized that one valuable thing we could offer was a free version of our Web filtering service for home users.” (see “Why are you giving away this software?”)

General, Internet filtering,
 

A team of researchers primarily from Princeton released Thursday, Feb. 21st, vulnerabilities in many full-disk encryption software packages that could allow attackers to gain access to the encryption key from RAM.  In most cases, the system would have to be compromised while on, or in "suspend" or "hibernate" mode; however, some exceptions exist.  To read the full research paper, watch the video, or review frequently asked questions go to http://citp.princeton.edu/memory/

Security and Compliance, Encryption,
 

Most of us know that digital cellular phone communications, such as global system for mobile communications (GSM), which many major service providers use, are encrypted. And some of us may know that it has been cracked.  And I suppose we all think that nobody, except maybe a government, has the equipment or know how to listen in...

A Forbes.com reports that in a presentation Wednesday at the Black Hat security conference, two young cyber-security researchers demonstrated a new technique for cracking the encryption used on GSM.  The encryption is used to prevent eavesdropping, but the two researchers say that by using their technology they can record a GSM cell phone conversation from miles away and decode it in about half an hour with just $1,000 in computer equipment. GSM is the most popular standard for mobile phones in the world and the most notable service providers using GSM in the U.S. are AT&T and T-Mobile. [more]

Keep in mind that this technology is for sale, so you might should consider your cellular phone communications to be about as secure as unencrypted e-mail of the Internet.

 To read the original Forbes.com article visited: http://www.forbes.com/2008/02/21/cellular-spying-decryption-tech-security-cx_ag_0221cellular.html

Security and Compliance, Cell Phones, Wiretapping,
 

With VMware Server (and most likely Workstation), you can connect a USB device to the VM.  I was using a USB flash drive to transfer a file because I didn’t want the VM on the network.  However the USB drive can’t be mounted to the host and VM at the same time.  If you connect the drive to the VM (using the VM->Removable Devices menu), it appears to the guest VM from disappears from the host.  After you disconnect from the VM it’s available again to the host system.  In hindsight this makes sense but it wasn’t immediately obvious to me when I was trying to copy the file.

Networking, VMware,