Diary of a Network Geek

Really?  Are they bringing this one out again?

I’ve heard about the dangers of “cyber war” almost since I got started in this business twenty years ago.  Essentially, since the internet existed, people have been claiming that dangerous hackers are going to take over our infrastructure from within.  Sound familiar?  Like, oh, say, the Red Threat of the Cold War?
It’s pretty easy to get IT guys like me whipped into a frenzy about this.  Back in the day, Winn Schwartau wrote THE go-to book on the subject, [amazon_link id=”B00127UJMO” target=”_blank” container=”” container_class=”” ]Information Warfare[/amazon_link], and in that book he talked about a so-called “Cyber Pearl Harbor” that ushered in a new era of digital warfare.  Well, now, it seems, ZDNet is reporting that we may have already had our so-called Cyber Pearl Harbor.  According to security researchers at McAfee, and elsewhere, several targets, including the United States, have been under a five year sustained cyber attack and they went on to speculate that a “state actor” was likely behind the attacks.  A security consultant at Sophos pointed out that fingers are usually pointed in China’s direction when government-funded and supported cyber attacks are discussed.  And, I have to admit, based on the other forms of espionage, especially industrial espionage, that we’ve seen from them over the years, it wouldn’t surprise me if they were using the Internet to attack various sites remotely in an attempt to get restricted information of various kinds.

But, is this a “Pearl Harbor”-like event?  I mean, really?
Do you see people rallying around this issue?  Are hackers joining the U.S. Military to defend our cyber borders?  If they are, it’s one of the best kept secrets in the world right now.  Seriously.
Pearl Harbor was a galvanizing event in our history.  That one event is what got us off the fence and into World War II, as a nation.  Honestly, I don’t see that happening here, or anywhere that high-level computer tech is the focal point of the debate.  We may rely on that tech to get our jobs done or to entertain us, but, really, most people don’t have any idea of the security work that goes on behind the scenes.  This is an invisible war, if it even can be called that.
Again, I think it’s a new form of Cold War.  It’s a battle waged in the shadows against an all but invisible enemy.  It won’t be fought like a conventional war of any kind, much less like World War II.  And, if the cyber war is an apt metaphor at all, then it’s a war we’re already fighting.

Oh, and as for the Chinese, well, they’ve already used their influence as a global market to get a partial retraction from those fine folks at McAfee, who are now claiming that there is no definitive link to any “state actor” of any kind, much less China.  Of course, I’ve only seen the back-peddling on a single, English-language, but Chinese supported, news site.  Still, that, my friends, is the view of the new global economy and the real war.  Big governments will start to throw their weight around and corporations will “adjust” their position on the truth to tap the market and access their bottom line.  Of course, that’s nothing new, either.  China’s been doing that for years.  Only now, they may be the biggest market still available in the entire world.
Looks like we all better start learning Mandarin!

No, not a flu that your synthetic humanoid might catch.

Virus writers target operating systems with a large installed user base.  There’s nothing controversial or even particularly interesting about that statement.  It’s a generally accepted concept based on observation, if not actual hard facts.  For a long time, that’s why there were so many viral attacks on Windows.  Windows enjoyed the greatest market penetration, so Windows users had to put up with the most frequent attempts to penetrate their machines.
But, that’s changing as the distribution of operating systems changes.  Android, in various forms and flavors, is now the most installed operating system.  Yeah, that’s right, someone has been writing viruses (virii ?) that attack your Android phone.

I’ve seen two new stories about this today.  One from a Houston local tech celebrity, Dwight Silverman over at the Houston Chronicle, and elsewhere, both talking about a new Android Trojan that can actually record your voice conversations.
One of the things that people like about Android is that it can load software from places other than a restricted, safe, controlled marketplace, but, that’s also one of the liabilities.  Apparently, the malware takes advantage of that ability to load itself onto your phone’s SIM chip and force the phone to record conversations to the chip then, optionally, upload those recordings to a server, presumably controlled by an attacker.  It’s somewhat unclear how that process would be initiated, but the simple fact that it can do it at all is chilling to me.  Also unclear from the articles was whether or not this has been spotted in the wild.
Hopefully, not yet.

So, here’s another warning for you.  Your devices, of any kind, are not safe.  Not ever.  If you have them powered on and they can connect to a network, even if you think they aren’t, you may still be vulnerable.  The Internet, in all its forms, is a wild and wooly and dangerous place.
Be careful out there, people.

I hope so!

And, by that I mean, I hope all that Mac Malware we heard about a couple weeks ago is gone.
Now, I know several Mac fanboy blogs linked to the note I put up about the Mac malware some time back thought I was going out of my way to bash Apple, but, honestly, nothing could be further from the truth.  In fact, I hadn’t given it another thought until Ed Bott wrote “Where did all the Mac malware go?”  I threw the original story out there as a warning to all the Apple users who think the Mac and OS X is entirely free from any malware and utterly safe.  That’s just not true.  It is, I have to admit, much safer, in general, than Windows.  There are a couple reasons for that, but, mostly, it’s because of market share and how Apple does, well, everything.

So, that last explosion of malware may be the only shot you hear fired.  At least, for a while.
Frankly, I hope so.  And, I hope that it put enough scare into people that they take security seriously anyway.  As Apple’s market share grows, their products will all become a more appealing target for hackers and crackers.  Though I hope to be proven wrong, I suspect that there is malware being written to attack Macs and, possibly, iPhones and iPads.   In fact, that malware may be already written and just waiting for the right infection vector.  Maybe.

Maybe I’m just a bit cynical and I’m waiting for the proverbial other shoe to drop.
For years, Apple fanboys have told people that Macs were completely virus free and were more secure by their very nature.  Sadly, that’s not true.  We’ve heard the first shots fired in a new skirmish in the secret war for desktops of all kinds.  It’s big business.  I don’ t think this is the last we’ve heard about Mac malware.
But, maybe I’m wrong.  Maybe Apple has closed that hole and all the other holes, too.  Maybe the Macs are all safe and that’s why we haven’t heard about that malware recently.
Maybe.

But, can you afford to take the chance?

Regular readers know I’m not a big fan of outsourcing.

I am, however, even less of a fan of off-shoring.
Now, before someone calls me racist again, let me say that I have no problem at all with non-US citizens making money, no matter what country they’re from.  Honest!  I’m friends with more than one proud Green Card holder!  But, I’m not a big fan of shipping jobs to a foreign country when someone right here in the United States is out of work and can do the job.  In fact, for years I’ve advocated what one company I worked for did; Rural Sourcing.

Of course, at the time, we didn’t call it that, but, as it turns out, that’s what it is.
We had a call center in a very rural town, connected to our data via a satellite.  In fact, they were connected to the same service bureau that we were.  It was a pretty good deal, all the way around.  We got decent, cheap labor, that spoke English without an accent to our American customers.  They got better jobs than the local sugar beet canning factory.  Yeah.  That was our employment competition.  Can you guess where the majority of the people in town wanted to work?  I’ll give you a hint, it wasn’t standing on a production line with high-speed machinery.

So, while this isn’t new, it is, apparently, a newish idea for corporate America at large.
In any case, take a look at the article on Tech Republic; First Rural Sourcing Effort Proves Successful.
As I mentioned, it’s not new at all, but it must be a new concept for the author of the article.  I think it’s a great idea.  It CAN be cost effective to use local developers and local call centers in rural areas.  I don’t think it’s wrong to try and pull some of this business back from overseas.  I think it’s good, smart business.

I’m always looking for short-cuts.

No, seriously, there’s only one of me and my time is in HUGE demand, especially at the office.  So, I’m always looking for ways to automate stuff so I don’t have to do it myself.  Back in 2008, I cobbled together an imaging system that relied on Linux and a whole lot of personal documentation.  (You can read that, in two parts, here and here.)  It worked pretty well and I was pretty damn proud of myself for both figuring it out and saving me a whole lot of time doing each individual install of a machine.

Well, recently, we’ve started upgrading our engineers and draftsmen to the latest version of AutoCAD and Windows 7.
Naturally, Windows 7 uses disks in a totally different way than Windows XP, so all that work I did is now pretty much useless.  Which, frankly, is par for the course in our line of work.  IT is always changing, so we have to adapt, whether we like it or not.  In this case, I don’t mind so much.  Why?  Because Clonezilla pretty much does everything that I was doing by hand, only it does it almost automagically.  Just to be clear, I’m using the Clonezilla Live version and saving the images to my server.  Now that I’ve upgraded the storage capacity to a little over 4 terabytes, I’m not so worried about saving images there.  Especially because I still have most of the office convinced we only have a single terabyte of storage and that they need to keep their directories on the server lean.  It doesn’t help much, but it’s enough.

Seriously, if you have to image machines, go check out Clonezilla.  It works and, best of all, it’s FREE!
(Also?  It’s pretty damn fast on my network, which is a huge bonus!)

I’m seeing traffic about this, so I thought I’d write up what I found.

I tweeted about a strange DNS-based network/malware attack that I saw on Friday, but, at the time, I didn’t see any interest, so I didn’t go into any real details.  Besides, I may be a hardcore geek, but I do have a life and was going out.  But, now, I’m seeing search engine traffic hitting my blog apparently looking for details, so I thought I’d describe the attack, as I saw it.

First of all, let me mention that I’ve seen a higher-than-usual occurrence of malware infections the past couple of weeks.  I mean, it’s a hazard of my business that, sooner or later, people are going to get infected, either through bad behavior or by accident, but the past three weeks or so I’ve seen way more problems like that than is even remotely normal.  So, bearing that in mind, I’ve been on a kind of high-alert status looking for any malware problems, but this was something new.

It started with someone from another location, who’s on a totally, physically separate network which uses a different internet service provider to connect to the Internet, calling me with a problem.  It was, apparently, a recurrence of a virus he had previously that we cleaned.  He described being taken to a webpage that featured a maroon graphic background with a white icon of a policeman holding up his hand to indicate “stop”.  The text on the page gave a message that said the user’s browser was not the correct version to access the page and that an upgrade was required.  Helpfully, it provided a button to press to receive the “upgrade”.  Obviously, the “upgrade” was an infection.  (You can see an example of the graphic here.)  Thankfully, I trained my users well enough to be suspicious of these kinds of things and no one who reported this actually clicked on it.

About the same time this happened, I noticed that my iPhone wasn’t connecting to the wifi hotspot I have setup in my office.  I checked the configuration and noticed that the DNS servers listed were wrong.  In fact, they’d all been replaced with a single DNS server; 188.229.88.7  Obviously, that seemed suspicious to me, so I opened a command prompt on my PC and did a tracert to see if I could figure out where this server was and, from that, why it had become the default DNS server on part of my network, despite my having very carefully configured totally different DNS servers that I knew were safe.  It looked like the tracert results showed me a network path that led out of the country somewhere, which was, to me, very suspicious.

Before I could really pursue that, though, I got another call from a user at my location reporting the exact same error message and graphic, but going to a totally different website! I went to his computer and checked the IP configuration and found that his DNS servers had been replaced by the rogue server as well.  I refreshed his network config, several times actually, and the DNS servers reset, but, when I thought to check some other people in the same area of the building, his configuration set itself back to the rogue DNS server!  So, I reset the local network equipment to clear the DNS cache, and whatever other caches may have gotten poisoned by this attack, and the problem seemed to go away.  Unfortunately, whatever had caused the compromise was still active and seemed to poison the DNS cache and the DNS configuration again.  It did seem sporadic, though, as if the ISP was trying to correct the issue at their end.

As far as I can tell, the attack actually seemed to be network-based in some way.
At least, I couldn’t find any computer on my network that was infected with anything that AVG, Norton Anti-virus, or Malware Bytes could find.  It is, I suppose, possible, that this attack was so new that no of those programs had an updated detection pattern for it, but, based on the lack of detection, and the fact that it happened on two physically separate networks almost simultaneously, leads me to believe that this was a network-based attack.  I suspect that an ARP cache or DNS cache or something similar was attacked and compromised on a major network router somewhere.  Possibly one of the edge routers at a trans-continental connection somewhere.  From the tracert results I had, it looked like it was the East Coast somewhere, leading to Europe via London to France, though I could be wrong.  It’s possible that was a blind alley meant to throw researchers off the trail in some way.
Also, as of this writing the rogue DNS server seems to be out of commission, though that might change, too.

The Internet is a wild and wooly place, ladies and gents, and you can’t always count on your friendly, neighborhood Network Geek to watch over you and keep you safe!  So, be careful out there!
(And, if you’re a fellow professional who’s seen this, too, leave me comments and tell me what you found!)
UPDATE: Looks like the server is still active, but my ISP has blocked DNS traffic to it, to fix the problem.
Also?  I hate the bastards that do these things.  I hate every last one of the little rat bastards!

UPDATE/FOLLOW-UP: So, it seems like a lot of people have been effected by this problem!
Check the comments for what other folks did and tools they might suggest to help with the problem.  Frankly, I wish I’d had known about those tools when I started my day!  Yes, I was *totally* wrong when I said it looked like it was coming in from outside the routers.  It was, in fact, *several* PCs that were infected with whatever it was.  I found it, much like at least one commenter, by checking the results of “ipconfig /all” in a command prompt.  I noticed that the DHCP server listed in the config was NOT my actual DHCP server!  So, as I went from machine to machine, I saw several PCs that kept coming up as DHCP servers.  I used Malware Bytes to scan the infected PCs and it seemed to clean them off.  At least, for now.  I’m not sure what I’ll find in the morning.
Apparently, Friday, when it looked like the problem was getting cleaned up, it was really just people shutting their workstations down early for the long weekend.
In any case, as at least one commenter has mentioned, it looks like updates for the various scanners should be coming out this week, so keep updating your antivirus and antispyware programs and scan your networks!  Well, scan them more completely and carefully than you already have.
And, as always, if you have any new information or suggestions for tools to clear up the issue, please, leave them in the comments!

Good news!

First, there are things you can do to protect yourself from this new Mac malware:
Start by disabling the automatic opening of downloaded files.  The world has changed for you Mac users and you simply can’t trust just any download any more.  Welcome to the world that Windows users have lived in for years and years.
Also, don’t let things install on your machine unless you’ve gone out looking for them!  Again, don’t trust anything that looks like an automatic update or a “free” program that wants to install automatically, especially if you haven’t been searching for any thing!
Seriously, you can’t trust people on the Internet.  I know this may come as a shock to the Hippie, “free-love” sort of people Mac users think themselves to generally be, but, yeah, not everyone on the Internet has your best interests at heart.  Well, except me.  You can trust me.  Honest.

Secondly, in a “few days” Apple will allegedly put out an update to make you safe again.
At least, that’s what they’re saying.  No definite deadline on that, though, so be careful and make sure to check your updates regularly!  Staying up to date on patches is one of the better ways to help prevent an infection.  Also, if you haven’t already, please, consider getting an anti-virus program for your Mac.  OS X is a growing target for hackers as the installed user-base grows, so, sooner or later, you’ll see more of these little nasties coming your way.  Your platform’s growing popularity will make it a growing target!  So, before it’s too late and you’re asking your friendly, neighborhood network geek for help in cleaning up the mess, install an anti-virus to prevent the mess in the first place.  The computer you save may be your own!

I told you Macs weren’t safe!

Does anyone listen to me?  No.  Well, hardly ever.
I’m sure you’ve seen the news by now that there are growing numbers of Mac malware attacks.  In fact, Apple Care, the official Apple customer service division, has reported a staggering jump in the number of malware related calls they received in just the past several weeks.  Apparently, according to the interview, it’s gotten to be quite a large problem in just that short amount of time.  They estimate that, now, up to 50% of all calls they get are related in some way to a malware attack on an Apple product.  The indication from the article is that everything is focused on Mac OS X machines, but, with larger market share comes a bigger prize for hackers, so don’t be surprised if iPhones and iPads and even iPods are attacked next!
Of course, what makes matters worse is that, allegedly, Apple Care representatives are being told not to help with malware attacks!  So, all that safety you thought you were buying with Mac?  Apparently, not the best investment.  Of course, security through obscurity never is.

So far, the threat seems to be confined to a single, aggressive bit of malware called MacDefender.  Go to the link and you’ll see a screenshot of what it looks like when it tries to install.  It looks just like a standard Mac program, right from Apple.  This is the same tactic that Windows users have been facing for years.  There’s nothing new here, outside of a new installed base of users who have never had to deal with malware before.  Mac users must look like sheep ready for fleecing to these crooks.  So, if you know Mac users, warn them and spread the word.

For those of you lucky enough to have escaped harm so far, buy and install an antivirus product and keep it up to date.
For those of you who haven’t been lucky, here’s a link to a MacDefender Malware Removal Guide. (Thanks, @joefarace!)

Incidentally, I’ve been talking about this for years.  I knew it would happen eventually, but, hey, who am I?  I mean, besides a front-line grunt that cleans up everyone’s machine when they get infected with digital herpes.  Not being a “pundit” or “respected industry figure” just means that no one takes you seriously, not that we don’t know what we’re talking about.  Because, believe me, I’m not the only network geek in the trenches who saw this coming.  We ALL did, but no one listens.

Like I wrote earlier, get the word out and show Mac users what they might expect before they get hit.
The day you save may be your own!

The myth of an operating system that is somehow safe from virii or malware is being busted.

No, seriously, I know all you Mac users are always bragging about how much more safe your operating system is because there isn’t any malware written to attack it.  I hear it all the time.  Well, guess what kids?  You’re wrong.  There is at least one OS X Crimeware Kit, in the wild.  And, really, that’s just the one that we’ve seen lately.  If researchers have found one, there are probably others.  And, I know that there are other exploits in the wild, too.  Not as many, sure, but they are out there.  And, thanks to you all bragging about how you’re safe and being all fan-boy about your OS and telling all your friends how great it is, you’re making OS X a more and more attractive target all the time.
Remember, the reason that Windows has so many exploits written for it is because it’s installed on so many computers.  It’s marketing, really.  Where’s the biggest potential market for software?  Right, on the biggest installed base of whatever the popular operating system is.  Now, if you were a virus writer, what would you write a virus to run on?  Same thing.  So, as markets expand, so will the exploits.

Brace yourself.  The world is changing.

Why does adding “cyber” to something make it so different?

So, recently, there was an article on Slashdot about “cyber vigilantes”; “Should Cyber Vigilantes Be Cheered Or Feared?”
Um, does being a troublemaker and scofflaw online make it less bad in some way?  I mean, a “cyber” vigilante is still a vigilante.  So, shouldn’t the question really be “Should we punish people who take the law in to their own hands?”  Isn’t that what the question is really saying?  Does it matter that it happened on-line or not?  Seriously?  When someone shuts down part of the financial system, like the ability of Visa to process credit charges, do we care that the people who did it were on-line or in the street?

I don’t care.  As far as I’m concerned, a vigilante is a vigilante.

Look, here’s my point;  There is NO difference between “cyberspace” and “real life”.  There never was.
Why do people still seem to get the idea that we’re different in some key way on-line than we are in person?  Do my values change because I’m sitting at a keyboard?  Does relative anonymity somehow exempt me from my regular standards of behavior and conduct?  No, in short, no, there is no difference.
I have had people say things to me from the safety of an e-mail or forum that they wouldn’t dare say to my face.  I know, because if they had, I’d have a criminal record and most likely be paying their hospital bill still.  Not that I’m a violent guy, on-line or anywhere else, really, but if I’d been within arm’s reach of some of the miscreants who’ve said things to provoke me, well…  Well, let’s just say that your Uncle Jim isn’t easily provoked and that’s best for everyone, okay?
So, riddle me this, dear readers, why do we still persist in the illusion that, somehow, we stop being people because of an intervening computer interface?

And, isn’t it time we stopped that?