Is your power supply compatible with NOSMOKE?
After experiencing difficulties with his computer, a poor, incognizant user called the system maker’s technical support line for assistance…
Technician: Hello. How can I help you today?
Customer: There’s smoke coming from the power supply on my computer…
Technician: Looks like you need a new power supply…
Customer: No, I don’t! I just need to change the startup files…
Technician: Sir, what you described is a faulty power supply. You need to replace it…
Customer: No way! Someone told me that I just had to change the system startup files to fix the problem! All I need is for you to tell me the right command…
For the next ten minutes, in spite of the technician’s efforts to explain the problem and its solution, the customer adamantly insisted that he was right. So, in frustration, the technician responded…
Technician: I’m sorry. We don’t normally tell our customers this, but there’s an undocumented DOS command that will fix the problem…
Customer: I knew it!
Technician: Just add the line ‘LOAD NOSMOKE.COM’ at the end of the CONFIG.SYS file and everything should work fine. Let me know how it goes…
About ten minutes later, the technician received a call back from the customer…
Customer: It didn’t work. The power supply is still smoking…
Technician: Well, what version of DOS are you using?
Customer: MS-DOS 6.22… Technician: Well, that’s your problem. That version of DOS doesn’t include NOSMOKE. You’ll need to contact Microsoft and ask them for a patch. Let me know how it all works out…
When nearly an hour had passed, the phone rang again…
Customer: I need a new power supply…
Technician: How did you come to that conclusion?
Customer: Well, I called Microsoft and told the technician what you said, and he started asking me questions about the make of the power supply…
Technician: What did he tell you?
Customer: He said my power supply isn’t compatible with NOSMOKE…
Categories: Humor Tags: computer technician, conclusion, config sys, dos command, frustration, Humor, microsoft, ms dos 6, nosmoke, power supply, problem customer, spite, supply customer, supply technician, system startup files, technical support line, undocumented dos
Microsoft Office 2010 Beta
So I am going through my email yesterday and I come across an email from TechNet announcing the beta of Microsoft 2010.
Even though I am a huge supporter of Open Office, I decided to give it a try. Since I already had a Hotmail account, the registration was very simple and within 5 minutes I was downloading the installer.
One of the first things I noticed when I began to install the application, was the options that were not selected. As seen in this screenshot, very few features are installed by default.
The install did seem to take a bit longer than normal, how much was part of the installer versus my test machine is undecided. None the less the installer did not take more than 20 minutes or so. Since I spend more time in the Word application that was where I headed first. It does appear that MS did listen to a lot of users concerning the start orb and has replaced it with the File tab. The remainder of the ribbon bar looks remarkably the same.
When you do go to the file tab, you get a lot more information at your mouse point without having to do a lot of digging.
So off I go. As I mentioned I use Open Office by default, so the first thing I did was open one of my documents created in Writer. It did take a few moments to bring the document up, but all of my formatting (such as it was) remained. I could even save it back into the .odt extension. There was the warning that the format was not completely compatible. I opened the file in Writer again and everything was golden. That was a big check mark in my books right there. Microsoft has been drug over the coals (rightfully so) for not being more compatible with other applications, this is a good step forward.
The next thing I wanted to look at was how it handles writing to a blog (not just Microsoft Live spaces). I realized how happy I was for the file menu to be back. With a couple of clicks I was being prompted to setup my blog connection. I selected Wordpress and entered the server and login information. Next time I know, I am writing the entry right now. One of the great features is the screenshot feature. Like the snipping tool in Vista and Windows 7, the screenshot tool is wonderful. When you go to insert you see the option screenshot, with the down arrow, you have the ability to just grab a full window or use the snipping tool. All of the images in this post were created using this format.
So far, I must say I am actually impressed with the direction of at least the Word portion. I will play with the excel portion later. Check back…
Categories: Reviews Tags: age, application, are, as, beta, blog, center, coals, comp, Content, Download, Email, Excel, family, far, few moments, file tab, formatting, Great, heck, Helpdesk, hotmail, hotmail account, Installer, mail, Micro, microsoft, microsoft live spaces, Microsoft Office, mom, mouse point, norm, odt extension, Office, Old, open office, orb, post, Read, REG, remainder, Ribbon, ribbon bar, screenshot, space, START, technet, test, test machine, text, the, tool, use, Vista, warning, Window, WINDOWS, word, word application, you
Abbot and Costello with new style ‘Who’s on First’
You have to be old enough to remember Abbott and Costello,
And too old to REALLY understand computers, to fully appreciate this. For those of us who sometimes get flustered by our computers, please read on…
If Bud Abbott and Lou Costello were alive today, their infamous sketch, ‘Who’s on First?‘might have turned out something like this:
COSTELLO CALLS TO BUY A COMPUTER FROM ABBOTT
ABBOTT: Super Duper computer store. Can I help you?
COSTELLO: Thanks I’m setting up an office in my den and I’m thinking about buying a computer.
ABBOTT: Mac?
COSTELLO: No, the name’s Lou.
ABBOTT: Your computer?
COSTELLO: I don’t own a computer. I want to buy one.
ABBOTT: Mac?
COSTELLO: I told you, my name’s Lou.
ABBOTT: What about Windows?
COSTELLO: Why? Will it get stuffy in here?
ABBOTT: Do you want a computer with Windows?
COSTELLO: I don’t know. What will I see when I look at the windows?
ABBOTT: Wallpaper.
COSTELLO: Never mind the windows. I need a computer and software.
ABBOTT: Software for Windows?
COSTELLO: No. On the computer! I need something I can use to write proposals,
Track expenses and run my business. What do you have?
ABBOTT: Office.
COSTELLO: Yeah, for my office. Can you recommend anything?
ABBOTT: I just did.
COSTELLO: You just did what?
ABBOTT: Recommend something.
COSTELLO: You recommended something?
ABBOTT: Yes.
COSTELLO: For my office?
ABBOTT: Yes.
COSTELLO: OK, what did you recommend for my office?
ABBOTT: Office.
COSTELLO: Yes, for my office!
ABBOTT: I recommend Office with Windows.
COSTELLO: I already have an office with windows! OK, let’s just say I’m sitting
At my computer and I want to type a proposal. What do I need?
ABBOTT: Word.
COSTELLO: What word?
ABBOTT: Word in Office.
COSTELLO: The only word in office is office.
ABBOTT: The Word in Office for Windows.
COSTELLO: Which word in office for windows?
ABBOTT: The Word you get when you click the blue ‘W’.
COSTELLO: I’m going to click your blue ‘W’ if you don’t start with some straight answers.
What about financial bookkeeping? You have anything I can track my money with?
ABBOTT: Money.
COSTELLO: That’s right. What do you have?
ABBOTT: Money.
COSTELLO: I need money to track my money?
ABBOTT: It comes bundled with your computer.
COSTELLO: What’s bundled with my computer?
ABBOTT: Money.
COSTELLO: Money comes with my computer?
ABBOTT: Yes. No extra charge.
COSTELLO: I get a bundle of money with my computer? How much?
ABBOTT: One copy.
COSTELLO: Isn’t it illegal to copy money?
ABBOTT: Microsoft gave us a license to copy Money.
COSTELLO: They can give you a license to copy money?
ABBOTT: Why not? THEY OWN IT!
(A few days later)
ABBOTT: Super Duper computer store. Can I help you?
COSTELLO: How do I turn my computer off?
ABBOTT: Click on ‘START’…
Categories: Humor Tags: abbot and costello, abbot costello, abbott and costello, abbott costello, age, are, as, bud abbott, bud abbott and lou costello, buying a computer, can, comp, computer, computer store, Content, family, few days, Financial, Helpdesk, lou costello, Micro, microsoft, new style, Office, Old, pape, proposal, proposals, Read, sketch, Software, START, the, title, track expenses, use, wallpaper, Window, WINDOWS, word, you
More Shortcuts for MS Word
Command Name Shortcut Keys ------------------------------------------------------------------------ All Caps CTRL+SHIFT+A Annotation ALT+CTRL+M App Maximize ALT+F10 App Restore ALT+F5 Apply Heading1 ALT+CTRL+1 Apply Heading2 ALT+CTRL+2 Apply Heading3 ALT+CTRL+3 Apply List Bullet CTRL+SHIFT+L Auto Format ALT+CTRL+K Auto Text F3 or ALT+CTRL+V Bold CTRL+B or CTRL+SHIFT+B Bookmark CTRL+SHIFT+F5 Browse Next CTRL+PAGE DOWN Browse Previous CTRL+PAGE UP Browse Sel ALT+CTRL+HOME Cancel ESC Center Para CTRL+E Change Case SHIFT+F3 Char Left LEFT Char Left Extend SHIFT+LEFT Char Right RIGHT Char Right Extend SHIFT+RIGHT Clear DELETE Close or Exit ALT+F4 Close Pane ALT+SHIFT+C Column Break CTRL+SHIFT+ENTER Column Select CTRL+SHIFT+F8 Copy CTRL+C or CTRL+INSERT Copy Format CTRL+SHIFT+C Copy Text SHIFT+F2 Create Auto Text ALT+F3 Customize Add Menu ALT+CTRL+= Customize Keyboard ALT+CTRL+NUM + Customize Remove Menu ALT+CTRL+- Cut CTRL+X or SHIFT+DELETE Date Field ALT+SHIFT+D Delete Back Word CTRL+BACKSPACE Delete Word CTRL+DELETE Dictionary ALT+SHIFT+F7 Do Field Click ALT+SHIFT+F9 Doc Close CTRL+W or CTRL+F4 Doc Maximize CTRL+F10 Doc Move CTRL+F7 Doc Restore CTRL+F5 Doc Size CTRL+F8 Doc Split ALT+CTRL+S Double Underline CTRL+SHIFT+D End of Column ALT+PAGE DOWN End of Column ALT+SHIFT+PAGE DOWN End of Doc Extend CTRL+SHIFT+END End of Document CTRL+END End of Line END End of Line Extend SHIFT+END End of Row ALT+END End of Row ALT+SHIFT+END End of Window ALT+CTRL+PAGE DOWN End of Window Extend ALT+CTRL+SHIFT+PAGE DOWN Endnote Now ALT+CTRL+D Extend Selection F8 Field Chars CTRL+F9 Field Codes ALT+F9 Find CTRL+F Font CTRL+D or CTRL+SHIFT+F Font Size Select CTRL+SHIFT+P Footnote Now ALT+CTRL+F Go Back SHIFT+F5 or ALT+CTRL+Z Go To CTRL+G or F5 Grow Font CTRL+SHIFT+. Grow Font One Point CTRL+] Hanging Indent CTRL+T Header Footer Link ALT+SHIFT+R Help F1 Hidden CTRL+SHIFT+H Hyperlink CTRL+K Indent CTRL+M Italic CTRL+I or CTRL+SHIFT+I Justify Para CTRL+J Left Para CTRL+L Line Down DOWN Line Down Extend SHIFT+DOWN Line Up UP Line Up Extend SHIFT+UP List Num Field ALT+CTRL+L Lock Fields CTRL+3 or CTRL+F11 Macro ALT+F8 Mail Merge Check ALT+SHIFT+K Mail Merge Edit Data Source ALT+SHIFT+E Mail Merge to Doc ALT+SHIFT+N Mail Merge to Printer ALT+SHIFT+M Mark Citation ALT+SHIFT+I Mark Index Entry ALT+SHIFT+X Mark Table of Contents Entry ALT+SHIFT+O Menu Mode F10 Merge Field ALT+SHIFT+F Microsoft Script Editor ALT+SHIFT+F11 Microsoft System Info ALT+CTRL+F1 Move Text F2 New CTRL+N Next Cell TAB Next Field F11 or ALT+F1 Next Misspelling ALT+F7 Next Object ALT+DOWN Next Window CTRL+F6 or ALT+F6 Normal ALT+CTRL+N Normal Style CTRL+SHIFT+N or ALT+SHIFT+CLEAR (NUM 5) Open CTRL+O or CTRL+F12 or ALT+CTRL+F2 Open or Close Up Para CTRL+0 Other Pane F6 or SHIFT+F6 Outline ALT+CTRL+O Outline Collapse ALT+SHIFT+- or ALT+SHIFT+NUM - Outline Demote ALT+SHIFT+RIGHT Outline Expand ALT+SHIFT+= Outline Expand ALT+SHIFT+NUM + Outline Move Down ALT+SHIFT+DOWN Outline Move Up ALT+SHIFT+UP Outline Promote ALT+SHIFT+LEFT Outline Show First Line ALT+SHIFT+L Overtype INSERT Page ALT+CTRL+P Page Break CTRL+ENTER Page Down PAGE DOWN Page Down Extend SHIFT+PAGE DOWN Page Field ALT+SHIFT+P Page Up PAGE UP Page Up Extend SHIFT+PAGE UP Para Down CTRL+DOWN Para Down Extend CTRL+SHIFT+DOWN Para Up CTRL+UP Para Up Extend CTRL+SHIFT+UP Paste CTRL+V or SHIFT+INSERT Paste Format CTRL+SHIFT+V Prev Cell SHIFT+TAB Prev Field SHIFT+F11 or ALT+SHIFT+F1 Prev Object ALT+UP Prev Window CTRL+SHIFT+F6 or ALT+SHIFT+F6 Print CTRL+P or CTRL+SHIFT+F12 Print Preview CTRL+F2 or ALT+CTRL+I Proofing F7 Redo ALT+SHIFT+BACKSPACE Redo or Repeat CTRL+Y or F4 or ALT+ENTER Repeat Find SHIFT+F4 or ALT+CTRL+Y Replace CTRL+H Reset Char CTRL+SPACE or CTRL+SHIFT+Z Reset Para CTRL+Q Revision Marks Toggle CTRL+SHIFT+E Right Para CTRL+R Save CTRL+S or SHIFT+F12 or ALT+SHIFT+F2 Save As F12 Select All CTRL+A or CTRL+CLEAR (NUM 5) or CTRL+NUM 5 Select Table ALT+CLEAR (NUM 5) Show All CTRL+SHIFT+8 Show All Headings ALT+SHIFT+A Show Heading1 ALT+SHIFT+1 Show Heading2 ALT+SHIFT+2 Show Heading3 ALT+SHIFT+3 Show Heading4 ALT+SHIFT+4 Show Heading5 ALT+SHIFT+5 Show Heading6 ALT+SHIFT+6 Show Heading7 ALT+SHIFT+7 Show Heading8 ALT+SHIFT+8 Show Heading9 ALT+SHIFT+9 Shrink Font CTRL+SHIFT+, Shrink Font One Point CTRL+[ Small Caps CTRL+SHIFT+K Space Para1 CTRL+1 Space Para15 CTRL+5 Space Para2 CTRL+2 Spike CTRL+SHIFT+F3 or CTRL+F3 Start of Column ALT+PAGE UP Start of Column ALT+SHIFT+PAGE UP Start of Doc Extend CTRL+SHIFT+HOME Start of Document CTRL+HOME Start of Line HOME Start of Line Extend SHIFT+HOME Start of Row ALT+HOME Start of Row ALT+SHIFT+HOME Start of Window ALT+CTRL+PAGE UP Start of Window Extend ALT+CTRL+SHIFT+PAGE UP Style CTRL+SHIFT+S Subscript CTRL+= Superscript CTRL+SHIFT+= Symbol Font CTRL+SHIFT+Q Thesaurus SHIFT+F7 Time Field ALT+SHIFT+T Toggle Field Display SHIFT+F9 Toggle Master Subdocs CTRL+\ Tool SHIFT+F1 Un Hang CTRL+SHIFT+T Un Indent CTRL+SHIFT+M Underline CTRL+U or CTRL+SHIFT+U Undo CTRL+Z or ALT+BACKSPACE Unlink Fields CTRL+6 or CTRL+SHIFT+F9 Unlock Fields CTRL+4 or CTRL+SHIFT+F11 Update Auto Format ALT+CTRL+U Update Fields F9 or ALT+SHIFT+U Update Source CTRL+SHIFT+F7 VBCode ALT+F11 Web Go Back ALT+LEFT Web Go Forward ALT+RIGHT Word Left CTRL+LEFT Word Left Extend CTRL+SHIFT+LEFT Word Right CTRL+RIGHT Word Right Extend CTRL+SHIFT+RIGHT Word Underline CTRL+SHIFT+W
Categories: Advice Tags: age, annotation, as, auto text, can, center, change case, Content, ctrl e, customize keyboard, data, f3, Find, heck, Home, hyperlink, mail, Micro, microsoft, object, Old, Past, print, Review, shortcut keys, shortcuts, size, space, START, system, text, the, tool, View, Web, Window, word, word command, word dictionary
Clampi Virus targets online banking
In the modern world, most people never see their bank (with the exception of ATM withdrawals). We use bill pay, direct deposit and bank debit cards. This is the exact behavior that the Clampi virus is living on.
Clampi is a very stealthy virus, just biding it’s time on a compromised machine and watching for connections to online financial websites. So many so that the London Times Online reports:
The trojan has a list of more than 4,500 finance-related websites that it monitors, including British high street banks. Security experts warned that it was one of the stealthiest and most pervasive threats to computers using the Microsoft Windows operating systems.
The virus appears to be geared with more of the business users instead of the normal home user (though it does infect home users). If the virus does end on a work computer, it will attempt to capture login credentials administrators and spread itself through the network. As it spreads, it continually monitors for login information to the watch list of financial websites. If this virus does infect the finance group of a company, it will attempt to send wire transfers from that account. You can ask Slack Auto Parts. It has been reported that they lost $75,000 July 3–7, says owner Henry Slack. Clampi-infected computers sent nine payments to six different mules � and failed to transfer an additional $69,000 in eight other attempts.
A word of warning, if your computer is designated for financial usage, please do not surf the internet or use social media sites to minimize the risk of infections.
Since this virus has been out for a while, all the major antivirus vendors have updated definition files that include the scan for this particular virus. Make sure your system is always updated and scanned on a regular basis. If you would like to run a quick check, using a different vendor, I recommend these online scanners:
TrendMicro: http://housecall65.trendmicro.com/
Symantec: http://security.symantec.com/sscv6/WelcomePage.asp
McAfee: http://home.mcafee.com/downloads/freescan.aspx?cid=60447
Panda: http://www.pandasecurity.com/activescan/index/
Categories: Malware Tags: age, amp, antivirus, antivirus vendors, are, as, atm withdrawals, attempts, bank debit cards, business users, can, comp, computer, Download, downloads, exact behavior, Files, finance group, financial websites, FREE, heck, henry slack, Home, home users, housecall65, Internet, login credentials, london times, mcafee, Micro, microsoft, microsoft windows, microsoft windows operating systems, online, panda, pervasive threats, ports, quick, Read, REG, scanner, Security, security experts, security symantec, street banks, symantec, system, the, title, Tree, trendmicro, use, virus, warning, Web, website, Welcome, Window, WINDOWS, windows operating system, windows operating systems, wire transfers, word, work computer, World, you
From Windows 1.0 to Windows 7 : Chronological Evolution
Have you ever wondered that how Windows evolved to such a beauty?
How was windows when it was first introduced and how it all improved? The Windows 7, Latest masterpiece by Microsoft offers a rich experience to users with its eye-candy animations and solid programming.
To have a peak at the evolution of Windows with time, read more. http://techtified.com/2009/08/from-windows-1–0-to-windows-7-chronological-evolution/
Categories: Microsoft Tags: animations, beauty, chronological evolution, eye candy, masterpiece, microsoft, rich experience, windows 1 0, windows evolution
What’s old is new again
Yesterday, Microsoft put out an advisory to a security vulnerability specific to the Windows Vista, Windows Server 2008 SP2, and Windows 7 RC operating systems. No other Windows operating systems, including Windows 7 RTM are impacted.
Holy cow, once again the older systems (you go XP) are more secure then the new systems. Why is that you say? Well this exploit was first found a decade ago. Yes, you did read that correct, in 1999 this was discovered and patched for the operating systems at the time. Yet no one thought to put that into the: Newest, Most Secure, Latest and Greatest operating systems.
So what is this vulnerability?
According to Microsoft:
What might an attacker use this vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Most attempts to exploit this vulnerability will cause an affected system to stop responding and restart.
I like the last four words, “stop responding and restart”. We had an acronym for that back in the day. BSOD. But out of all of this, the thing that bothers me the most is Microsoft’s response:
Microsoft is concerned that this new report of a vulnerability was not responsibly disclosed, potentially putting computer users at risk. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone’s best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.
Microsoft is concerned that this new report of a vulnerability was not responsibly disclosed? Excuse me what? It’s not new, it was disclosed properly the first time. Why do others become responsible for your oversight?
With that said Microsoft has issued two do it yourself resolutions until they can get a patch pushed.
The first is to Disable SMB2 in the registry:
Impact of workaround. Host will not be able to communicate using SMB2.
- Click Start, click Run, type Regedit in the Open box, and then click OK.
- Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services - Click LanmanServer.
- Click Parameters.
- Right-click to add a new DWORD (32 bit) Value.
- Enter smb2 in the Name data field, and change the Value data field to 0.
- Exit.
- Restart the “Server” service by performing one of the following:
- Open up the computer management MMC, navigate to Services and Applications, click Services, right-click the Server service name and click Restart. Answer Yes in the pop-up menu.
- From a command prompt and with administrator privileges, type net stop server and then net start server.
The second is to Block TCP ports 139 and 445 at the firewall:
Impact of Workaround: Several Windows services use the affected ports. Blocking connectivity to the ports may cause various applications or services to not function. Some of the applications or services that could be impacted are listed below:
- Applications that use SMB (CIFS)
- Applications that use mailslots or named pipes (RPC over SMB)
- Server (File and Print Sharing)
- Group Policy
- Net Logon
- Distributed File System (DFS)
- Terminal Server Licensing
- Print Spooler
- Computer Browser
- Remote Procedure Call Locator
- Fax Service
- Indexing Service
- Performance Logs and Alerts
- Systems Management Server
- License Logging Service
Personally, I would block those on your internet facing firewall of you broadband router.
Categories: Windows Tags: acronym, age, Alert, application, are, as, attack, attacker, attackers, attempts, back in the day, Blocking, Blogs, broadband, bsod, can, color, comp, complete control, computer, computer users, data, disclosure, Find, fire, Firewall, FREE, fun, gem, Great, holy cow, Internet, mail, malicious attackers, Micro, microsoft, Old, oversight, ports, print, quality updates, Read, REG, registry, resolutions, rtm, Security, security vulnerabilities, security vulnerability, sp2, START, system, test, the, title, Updates, use, Vista, vulnerabilities, Window, WINDOWS, windows operating system, windows operating systems, windows server, word, you
10 Immutable Laws of Security
Love Microsoft or hate them, this list of the 10 Immutable Laws of Security is dead on.
Law #1: If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore
It’s an unfortunate fact of computer science: when a computer program runs, it will do what it’s programmed to do, even if it’s programmed to be harmful. When you choose to run a program, you are making a decision to turn over control of your computer to it. Once a program is running, it can do anything, up to the limits of what you yourself can do on the computer. It could monitor your keystrokes and send them to a website. It could open every document on the computer, and change the word “will” to “won’t” in all of them. It could send rude emails to all your friends. It could install a virus. It could create a “back door” that lets someone remotely control your computer. It could dial up an ISP in Katmandu. Or it could just reformat your hard drive.
That’s why it’s important to never run, or even download, a program from an untrusted source—and by “source,” I mean the person who wrote it, not the person who gave it to you. There’s a nice analogy between running a program and eating a sandwich. If a stranger walked up to you and handed you a sandwich, would you eat it? Probably not. How about if your best friend gave you a sandwich? Maybe you would, maybe you wouldn’t—it depends on whether she made it or found it lying in the street. Apply the same critical thought to a program that you would to a sandwich, and you’ll usually be safe.
Law #2: If a bad guy can alter the operating system on your computer, it’s not your computer anymore
In the end, an operating system is just a series of ones and zeroes that, when interpreted by the processor, cause the computer to do certain things. Change the ones and zeroes, and it will do something different. Where are the ones and zeroes stored? Why, on the computer, right along with everything else! They’re just files, and if other people who use the computer are permitted to change those files, it’s “game over”.
To understand why, consider that operating system files are among the most trusted ones on the computer, and they generally run with system-level privileges. That is, they can do absolutely anything. Among other things, they’re trusted to manage user accounts, handle password changes, and enforce the rules governing who can do what on the computer. If a bad guy can change them, the now-untrustworthy files will do his bidding, and there’s no limit to what he can do. He can steal passwords, make himself an administrator on the computer, or add entirely new functions to the operating system. To prevent this type of attack, make sure that the system files (and the registry, for that matter) are well protected.
Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore
Oh, the things a bad guy can do if he can lay his hands on your computer! Here’s a sampling, going from Stone Age to Space Age:
- He could mount the ultimate low-tech denial of service attack, and smash your computer with a sledgehammer.
- He could unplug the computer, haul it out of your building, and hold it for ransom.
- He could boot the computer from a floppy disk, and reformat your hard drive. But wait, you say, I’ve configured the BIOS on my computer to prompt for a password when I turn the power on. No problem – if he can open the case and get his hands on the system hardware, he could just replace the BIOS chips. (Actually, there are even easier ways).
- He could remove the hard drive from your computer, install it into his computer, and read it.
- He could make a duplicate of your hard drive and take it back his lair. Once there, he’d have all the time in the world to conduct brute-force attacks, such as trying every possible logon password. Programs are available to automate this and, given enough time, it’s almost certain that he would succeed. Once that happens, Laws #1 and #2 above apply.
- He could replace your keyboard with one that contains a radio transmitter. He could then monitor everything you type, including your password.
Always make sure that a computer is physically protected in a way that’s consistent with its value—and remember that the value of a computer includes not only the value of the hardware itself, but the value of the data on it, and the value of the access to your network that a bad guy could gain. At a minimum, business-critical computers like domain controllers, database servers, and print/file servers should always be in a locked room that only people charged with administration and maintenance can access. But you may want to consider protecting other computers as well, and potentially using additional protective measures.
If you travel with a laptop, it’s absolutely critical that you protect it. The same features that make laptops great to travel with – small size, light weight, and so forth—also make them easy to steal. There are a variety of locks and alarms available for laptops, and some models let you remove the hard drive and carry it with you. You also can use features like the Encrypting File System in Microsoft Windows® 2000 to mitigate the damage if someone succeeded in stealing the computer. But the only way you can know with 100% certainty that your data is safe and the hardware hasn’t been tampered with is to keep the laptop on your person at all times while traveling.
Law #4: If you allow a bad guy to upload programs to your website, it’s not your website any more
This is basically Law #1 in reverse. In that scenario, the bad guy tricks his victim into downloading a harmful program onto his computer and running it. In this one, the bad guy uploads a harmful program to a computer and runs it himself. Although this scenario is a danger anytime you allow strangers to connect to your computer, websites are involved in the overwhelming majority of these cases. Many people who operate websites are too hospitable for their own good, and allow visitors to upload programs to the site and run them. As we’ve seen above, unpleasant things can happen if a bad guy’s program can run on your computer.
If you run a website, you need to limit what visitors can do. You should only allow a program on your site if you wrote it yourself, or if you trust the developer who wrote it. But that may not be enough. If your website is one of several hosted on a shared server, you need to be extra careful. If a bad guy can compromise one of the other sites on the server, it’s possible he could extend his control to the server itself, in which he could control all of the sites on it—including yours. If you’re on a shared server, it’s important to find out what the server administrator’s policies are.
Law #5: Weak passwords trump strong security
The purpose of having a logon process is to establish who you are. Once the operating system knows who you are, it can grant or deny requests for system resources appropriately. If a bad guy learns your password, he can log on as you. In fact, as far as the operating system is concerned, he is you. Whatever you can do on the system, he can do as well, because he’s you. Maybe he wants to read sensitive information you’ve stored on your computer, like your e-mail. Maybe you have more privileges on the network than he does, and being you will let him do things he normally couldn’t. Or maybe he just wants to do something malicious and blame it on you. In any case, it’s worth protecting your credentials.
Always use a password—it’s amazing how many accounts have blank passwords. And choose a complex one. Don’t use your dog’s name, your anniversary date, or the name of the local football team. And don’t use the word “password”! Pick a password that has a mix of upper– and lower-case letters, number, punctuation marks, and so forth. Make it as long as possible. And change it often. Once you’ve picked a strong password, handle it appropriately. Don’t write it down. If you absolutely must write it down, at the very least keep it in a safe or a locked drawer—the first thing a bad guy who’s hunting for passwords will do is check for a yellow sticky note on the side of your screen, or in the top desk drawer. Don’t tell anyone what your password is. Remember what Ben Franklin said: two people can keep a secret, but only if one of them is dead.
Finally, consider using something stronger than passwords to identify yourself to the system.
Law #6: A computer is only as secure as the administrator is trustworthy
Every computer must have an administrator: someone who can install software, configure the operating system, add and manage user accounts, establish security policies, and handle all the other management tasks associated with keeping a computer up and running. By definition, these tasks require that he have control over the computer. This puts the administrator in a position of unequalled power. An untrustworthy administrator can negate every other security measure you’ve taken. He can change the permissions on the computer, modify the system security policies, install malicious software, add bogus users, or do any of a million other things. He can subvert virtually any protective measure in the operating system, because he controls it. Worst of all, he can cover his tracks. If you have an untrustworthy administrator, you have absolutely no security.
When hiring a system administrator, recognize the position of trust that administrators occupy, and only hire people who warrant that trust. Call his references, and ask them about his previous work record, especially with regard to any security incidents at previous employers. If appropriate for your organization, you may also consider taking a step that banks and other security-conscious companies do, and require that your administrators pass a complete background check at hiring time, and at periodic intervals afterward. Whatever criteria you select, apply them across the board. Don’t give anyone administrative privileges on your network unless they’ve been vetted – and this includes temporary employees and contractors, too.
Next, take steps to help keep honest people honest. Use sign-in/sign-out sheets to track who’s been in the server room. (You do have a server room with a locked door, right? If not, re-read Law #3). Implement a “two person” rule when installing or upgrading software. Diversify management tasks as much as possible, as a way of minimizing how much power any one administrator has. Also, don’t use the Administrator account—instead, give each administrator a separate account with administrative privileges, so you can tell who’s doing what. Finally, consider taking steps to make it more difficult for a rogue administrator to cover his tracks. For instance, store audit data on write-only media, or house System A’s audit data on System B, and make sure that the two systems have different administrators. The more accountable your administrators are, the less likely you are to have problems.
Law #7: Encrypted data is only as secure as the decryption key
Suppose you installed the biggest, strongest, most secure lock in the world on your front door, but you put the key under the front door mat. It wouldn’t really matter how strong the lock is, would it? The critical factor would be the poor way the key was protected, because if a burglar could find it, he’d have everything he needed to open the lock. Encrypted data works the same way—no matter how strong the crypto algorithm is, the data is only as safe as the key that can decrypt it.
Many operating systems and cryptographic software products give you an option to store cryptographic keys on the computer. The advantage is convenience – you don’t have to handle the key – but it comes at the cost of security. The keys are usually obfuscated (that is, hidden), and some of the obfuscation methods are quite good. But in the end, no matter how well-hidden the key is, if it’s on the computer it can be found. It has to be – after all, the software can find it, so a sufficiently-motivated bad guy could find it, too. Whenever possible, use offline storage for keys. If the key is a word or phrase, memorize it. If not, export it to a floppy disk, make a backup copy, and store the copies in separate, secure locations. (All of you administrators out there who are using Syskey in “local storage” mode—you’re going to reconfigure your server right this minute, right?)
Law #8: An out of date virus scanner is only marginally better than no virus scanner at all
Virus scanners work by comparing the data on your computer against a collection of virus “signatures”. Each signature is characteristic of a particular virus, and when the scanner finds data in a file, email, or elsewhere that matches the signature, it concludes that it’s found a virus. However, a virus scanner can only scan for the viruses it knows about. It’s vital that you keep your virus scanner’s signature file up to date, as new viruses are created every day.
The problem actually goes a bit deeper than this, though. Typically, a new virus will do the greatest amount of damage during the early stages of its life, precisely because few people will be able to detect it. Once word gets around that a new virus is on the loose and people update their virus signatures, the spread of the virus falls off drastically. The key is to get ahead of the curve, and have updated signature files on your computer before the virus hits.
Virtually every maker of anti-virus software provides a way to get free updated signature files from their website. In fact, many have “push” services, in which they’ll send notification every time a new signature file is released. Use these services. Also, keep the virus scanner itself—that is, the scanning software—updated as well. Virus writers periodically develop new techniques that require that the scanners change how they do their work.
Law #9: Absolute anonymity isn’t practical, in real life or on the Web
All human interaction involves exchanging data of some kind. If someone weaves enough of that data together, they can identify you. Think about all the information that a person can glean in just a short conversation with you. In one glance, they can gauge your height, weight, and approximate age. Your accent will probably tell them what country you’re from, and may even tell them what region of the country. If you talk about anything other than the weather, you’ll probably tell them something about your family, your interests, where you live, and what you do for a living. It doesn’t take long for someone to collect enough information to figure out who you are. If you crave absolute anonymity, your best bet is to live in a cave and shun all human contact.
The same thing is true of the Internet. If you visit a website, the owner can, if he’s sufficiently motivated, find out who you are. After all, the ones and zeroes that make up the Web session have to be able to find their way to the right place, and that place is your computer. There are a lot of measures you can take to disguise the bits, and the more of them you use, the more thoroughly the bits will be disguised. For instance, you could use network address translation to mask your actual IP address, subscribe to an anonymizing service that launders the bits by relaying them from one end of the ether to the other, use a different ISP account for different purposes, surf certain sites only from public kiosks, and so on. All of these make it more difficult to determine who you are, but none of them make it impossible. Do you know for certain who operates the anonymizing service? Maybe it’s the same person who owns the website you just visited! Or what about that innocuous website you visited yesterday, that offered to mail you a free $10 off coupon? Maybe the owner is willing to share information with other website owners. If so, the second website owner may be able to correlate the information from the two sites and determine who you are.
Does this mean that privacy on the Web is a lost cause? Not at all. What it means is that the best way to protect your privacy on the Internet is the same as the way you protect your privacy in normal life—through your behavior. Read the privacy statements on the websites you visit, and only do business with ones whose practices you agree with. If you’re worried about cookies, disable them. Most importantly, avoid indiscriminate Web surfing—recognize that just as most cities have a bad side of town that’s best avoided, the Internet does too. But if it’s complete and total anonymity you want, better start looking for that cave.
Law #10: Technology is not a panacea
Technology can do some amazing things. Recent years have seen the development of ever-cheaper and more powerful hardware, software that harnesses the hardware to open new vistas for computer users, as well as advancements in cryptography and other sciences. It’s tempting to believe that technology can deliver a risk-free world, if we just work hard enough. However, this is simply not realistic.
Perfect security requires a level of perfection that simply doesn’t exist, and in fact isn’t likely to ever exist. This is true for software as well as virtually all fields of human interest. Software development is an imperfect science, and all software has bugs. Some of them can be exploited to cause security breaches. That’s just a fact of life. But even if software could be made perfect, it wouldn’t solve the problem entirely. Most attacks involve, to one degree or another, some manipulation of human nature—this is usually referred to as social engineering. Raise the cost and difficulty of attacking security technology, and bad guys will respond by shifting their focus away from the technology and toward the human being at the console. It’s vital that you understand your role in maintaining solid security, or you could become the chink in your own systems’ armor.
The solution is to recognize two essential points. First, security consists of both technology and policy—that is, it’s the combination of the technology and how it’s used that ultimately determines how secure your systems are. Second, security is journey, not a destination—it isn’t a problem that can be “solved” once and for all; it’s a constant series of moves and countermoves between the good guys and the bad guys. The key is to ensure that you have good security awareness and exercise sound judgment. There are resources available to help you do this. The Microsoft Security website, for instance, has hundreds of white papers, best practices guides, checklists and tools, and we’re developing more all the time. Combine great technology with sound judgment, and you’ll have rock-solid security.
Categories: Advice Tags: back door, computer, computer program, critical thought, hack, immutable laws, katmandu, keystrokes, laws, microsoft, rude emails, Security, unfortunate fact, untrusted source, zeroes
Find your Microsoft Product Key
It is that time again. Time to reimage your Windows PC. You have gone through the checklist: Backup data, found all of the drivers you will need, have your programs ready for reinstall, Windows install CD, Product key for CD. Ok, except for that last one. That blasted key. Now you are thinking “How will I install my OS without that?”
Never fear, there is an app for that. Magical Jelly Bean Keyfinder.
This handy tool is on my USB disk that I always bring with me. Most people I have helped with reimaging a PC do not have their product key anymore for whatever reason. With this tool and about 2 seconds of your time, you will be presented with the Product Key. The website reports that it can pull the Product key for all Windows products up to Vista (sorry Windows 7 beta users) and Microsoft Office up to 2007.
It is not a bad idea to get this information for your records anyways, just in case your system crashes.
Categories: SW Tags: backup data, beta users, handy tool, jelly bean keyfinder, magical jelly bean, microsoft, Microsoft Office, microsoft product key, system crashes, usb disk, windows pc, windows products
New Computer Security Mistakes
I wanted to pass on what I see as some of the top computer security mistakes that most casual computers users make when first setting up a new computer:
- Setting an non protected newly imaged computer on the internet. Before installing any computer on the internet, you will want to install at least an antivirus and make sure that the built in firewall for Windows is opened. I personally have a DVD with a lot of first install applications on it. This includes Comodo Antivirus, Comodo Firewall, Windows XP Service Pack 3 (Network Admin Installer), and Vista Service Pack 2 (Network Admin Installer). As well as a few other odds and ends. I run these installs before I ever connect my machine to the wireless network. I know the virus definition files for the Antivirus will be outdated, but that is corrected shortly.
- Not running updates as soon as online. After installing all the applications mentioned above, I get my system on the network and run updates on my antivirus software and then running the Windows Update. This is a very important step. Just because an antivirus is installed or the latest Service Pack applied, it does not mean you are protected. With more and more vulnerabilities and viruses being released daily, it is a never ending battle to keep yourself protected. Not only should you worry about the security software, but any application you install, please run all the updates.
- Setting your primary login ID as an administrator. I know this one is hard, but it has been brought to my attention, and rightfully so, it is not recommended. An administrator account has unlimited rights and power on a computer. You can create a separate user and make is a power user. For the Administrator account, you should rename it from Administrator and put a secure password on it. Also, disable the guest account on your system for safety measures.
- Password, Password, Password, and did I mention password? I know this is your home computer and you wonder who would get into it. Well, since the computer has become so integrated in our lives, we store everything on there. From bank information, important documents, Tax information, families information, on and on. If your computer gets stolen, someone else now has all of that information. If you do not have a secure password (see earlier posting) then it’s easy for them to get in.
- Disk Encryption.This is a topic I will discuss more in depth in the next few days. There are many free drive encryption applications available that are very very good. The reason for this encryption is so that if someone comes in and just grabs your drive out of your computer (less then 3 minutes for the most part) your data is secured. See item 4.
- Wireless Network Security. Again another topic I will get into later, but for the most part I can sum it up quickly. If you get a brand new wireless router, the defaults are the same. The same IP address, the same root password, the same SSID (Network name). With this information anyone in your area can get into your network. There are some things you can do to protect yourself and I plan on discussing it later, including what some recommended settings are. So please check back.
I hope that you found this useful information. Questions, comments and feedback is always welcome.
Categories: General Tags: administrator account, age, amp, antivirus software, application, are, as, can, casual, Comodo, comp, computer, computer security, disk, Download, downloads, family, Files, fire, Firewall, FREE, home computer, inpost, Installer, microsoft, network admin, new computer, odds and ends, online, password, passwords, quick, Safety, safety measures, Security, security software, service pack 2, service pack 3, Software, system, test, the, virus, virus definition files, viruses, Vista, vista service pack, vulnerabilities, Welcome, WINDOWS, windows xp, windows xp service pack, word, you
