Distributed Denial of Service, Amazon Cloud & Consequences

[Amazon Web Services Logo, Courtesy Amazon]

Distributed Denial of Service, Amazon Cloud & Consequences

Abstract

The US Military had been involved in advancing the art of computing infrastructure since the early days of computing. With many clouds built inside the Pentagon, a desire to standardize on an external cloud vendor was initiated. Unlike many contracts, where vendors were considered to compete with one another for a piece of the pie, this was a "live and let die" contract, for the whole proverbial pie, not just a slice. Many vendors & government proponents did not like this approach, but the proverbial "favoured son", who had a CIA contract, approved. This is that son's story.

Problems of Very Few Large Customers

Very few large customers create distortions in the market.

1. Many understand that consolidate smaller contracts into very few large contracts is unhealthy. Few very large single consumers, like the Military, create an environment where  suppliers will exit the business, if they can not win some business, since the number of buyers is too small, limiting possible suppliers in time of war.
2. Some complain that personal disputes can get in the way of objective decision making, in large business transactions.
3. Others warn that political partisanship can wreck otherwise potential terrific technology decisions.
4. Many complain that only a few large contracts offer opportunity for corruption at many levels, because the stakes are so high for the huge entities trying to gain that business.
5. In older days, mistakes by smaller suppliers gave opportunity for correction, before the next bid... but when very few bids are offered, fleeting opportunities require substantially deep pockets to survive a bid loss
6. Fewer customer opportunities discourages innovation, since risk to be innovative may result in loss of an opportunity when a few RFP providers may be rigidly bound by restraints of older technology requests and discourages from higher costing newer technology opportunities

In the end, these logical issues may not have been the only realistic problems.

[Amazon Gift Card, Courtesy Amazon]

Amazon's Business to Lose

From the very beginning, Amazon's Jeff Bezos had his way in. Former Defense Secretary James Mattis, hired Washington DC Lobbyist Sally Donnelly, who formerly worked for Amazon, and the Pentagon was soon committed to moving all their data to the private cloud. The irony is that Bezos, who has a bitter disagreement with President Trump, now had a proverbial "ring in the nose" of President Trump's "second in command" with the Armed Forces, in 2017.

Amazon's Anthony DeMartino, a former deputy chief of staff in the secretary of defense’s office, who previously consulted for Amazon Web Services, was also extended a job at Amazon, after working through the RFP process.

Features of the Amazon Cloud, suspiciously looked like they were taylor written for Amazon, requesting features that only Amazon could offer. Competitors like Oracle had changed their whole business model, to redirect all corporate revenue into Cloud Computing, to even qualify for the $2 Billion in revenue requirement to be allowed to bid on the RFP! How did such requirements appear?

Amazon's Deap Ubhi left the AWS Cloud Division, to work at the Pentagon, to create the JEDI procurement contract, and later return to Amazon. Ubhi, a venture capitalist, worked as 1 of a 4 person team, to shape the JEDI procurement process, while in secret negotiations with Amazon to be re-hired for a future job. The Intercept further reminded us:

Under the Procurement Integrity Act, government officials who are “contacted by a [contract] bidder about non-federal employment” have two options: They must either report the contact and reject the offer of employment or promptly recuse themselves from any contract proceedings.

The Intercept also noted that Ubhi accepted a verbal offer from Amazon, for the purchase of one of his owned companies, during the time of his working on the Market Research that would eventually form the RFP.

A third DoD individual, tailoring the RFP, was also offered a job at Amazon, according to Oracle court filings, but this person was marked from the record.

At the highest & lowest levels, the JEDI contract appeared to be "Gift-Wrapped" for Amazon.

[Amazon CEO Jeff Bezos hosting Trump's Former Defense Secretary James Mattis at HQ, courtesy Twitter]

Amazon Navigating Troubled Waters

December 23, 2018, President Trump pushes out Secretary of Defense James Mattis after Mattis offered a resignation letter, effective February 2019.

January 24, 2019, Pentagon investigates Oracle concerns unfair practices by hiring Cloud Procurement Contract worker from Amazon.

April 11, 2019, Microsoft & Amazon become finalists in the JEDI cloud bidding, knocking out other competitors like Oracle & IBM.

June 28, 2019, Oracle Corporation files lawsuit against Federal Government for creating RFP rules which violate various Federal Laws, passed by Congress, to restrict corruption. Oracle also argued that three individuals, who tilted the process towards Amazon, who were effectively "paid off" by receiving jobs at Amazon.

July 12, 2019, Judge rules against Oracle in lawsuit over bid improprieties, leaving Microsoft & Amazon as finalists.

August 9, 2019, Newly appointed Secretary of Defense Mark Esper and was to complete "a series of thorough reviews of the technology" before the JEDI procurement is executed.

On August 29, 2019, the Pentagon awarded it's DEOS (Defense Enterprise Office Solutions) cloud contract, a 10-year, $7.6 billion, to Microsoft, based upon their 365 platform.

On October 22, 2019, Secretary of Defense Mark Esper withdrew from reviewing bids on the JEDI contract, due to his son being employed by one of the previous losing bidders.

Serendipity vs Spiral Death Syndrome

Serendipity is the occurrence and development of events by chance with a beneficial results. The opposite may be Spiral Death Syndrome, when an odd event may create a situation where catastrophic failure becomes unavoidable.

What happens when an issue, possibly out of the control of a bidder, becomes news during a vendor choice?

This may have occurred with Amazon AWS, in their recent bid for a government contract. Amazon pushed to have the Pentagon Clouds outsourced, at one level below The President and even had the rules written for an RFP, to favor a massive $10 Billion 10 year single contract agreement favoring them.

October 22, 2019, A Distributed Denial of Service (DDoS) hitsAmazon Web Services was hit by a Distributed Denial of Service attack, taking down users of Amazon AWS for hours. Oddly enough, it was a DNS attack, centered upon Amazon C3 storage objects. External vendors measured the outages to last 13 hours.

On October 25, 2019, the Pentagon awarded it's JEDI (Joint Enterprise Defense Infrastructure) cloud contract, a 10-year, $10 billion, to Microsoft. The Pentagon had over 500 separate clouds, to be unified under Microsoft, and it looks like Microsoft will do the work, with the help of smaller partners.

Conclusions:

Whether the final choice of the JEDI provider was Serendipitous for Microsoft, or the result of Spiral Death Syndrome for Amazon, is for the reader to decide. For this writer, the final stages of choosing a bidder, where the favoured bidder looks like they could have been manipulating the system at the highest & lowest levels of government, even having the final newly installed firewall [Mark Esper] torn down 3 days earlier, is an amazing journey. A 13 hour cloud outage seems to have been the final proverbial "nail in the coffin" for a skilled new bidder who was poised to become the ONLY cloud service provider to the U.S. Department of Defense.

(Full Disclosure: a single cloud outage for Pentagon Data, just before a pre-emptive nuclear attack on the United States & European Allies [under our nuclear umbrella], lasting 13 hours, could have not only been disastrous, but could have wiped out Western Civilization. Compartmentalization of data is critical for data security and the concept of a single cloud seems ill-baked, in the opinion of this writer.)

Security: 2015q1 Concerns

Viruses, Worms, Vulnerabilities and Spyware concerns during and just prior 2015 Q1.

• [2015-03-07] Litecoin-mining code found in BitTorrent app, freeloaders hit the roof
  "μTorrent users are furious after discovering their favorite file-sharing app is quietly bundled with a Litecoin mining program. The alt-coin miner is developed by distributed computing biz Epic Scale, and is bundled in some installations of μTorrent, which is a Windows BitTorrent client. Some peeps are really annoyed that Epic's code is running in the background while they illegally pirate torrent movies and Adobe Creative Suite Linux ISOs, and say they didn't ask for it to be installed."
  
  
• [2015-03-06] FREAKing HELL: All Windows versions vulnerable to SSL snoop
  "Microsoft has confirmed that its implementation of SSL/TLS in all versions of Windows is vulnerable to the FREAK encryption-downgrade attack. This means if you're using the firm's Windows operating system, an attacker on your network can potentially force Internet Explorer and other software using the Windows Secure Channel component to deploy weak encryption over the web. Intercepted HTTPS connections can be easily cracked, revealing sensitive details such as login cookies and banking information, but only if the website or service at the other end is still supporting 1990s-era cryptography (and millions of sites still are)."
  
  
• [2015-03-05] Broadband routers: SOHOpeless and vendors don't care
  "Home and small business router security is terrible. Exploits emerge with depressing regularity, exposing millions of users to criminal activities. Many of the holes are so simple as to be embarrassing. Hard-coded credentials are so common in small home and office routers, comparatively to other tech kit, that only those with tin-foil hats bother to suggest the flaws are deliberate."
  
• [2015-03-05] Obama criticises China's mandatory backdoor tech import rules
  "US prez Barack ‪Obama has criticised China's new tech rules‬, urging the country to reverse the policy if it wants a business-as-usual situation with the US to continue. As previously reported, proposed new regulations from the Chinese government would require technology firms to create backdoors and provide source code to the Chinese government before technology sales within China would be authorised. China is also asking that tech companies adopt Chinese encryption algorithms and disclose elements of their intellectual property."
  
• [2015-03-05] Sales up at NSA SIM hack scandal biz Gemalto
  "Sales at the world's biggest SIM card maker, Gemalto, which was last month revealed to have been hacked by the NSA and GCHQ, rose by five per cent to €2.5bn (£1.8bn) in 2014. Following the hack, the company's share price fell by $470m last month. In February, it was revealed that the NSA and Britain's GCHQ had hacked the company to harvest the encryption keys, according to documents leaked by former NSA sysadmin, whistleblower Edward Snowden."
  
  
• [2015-02-24] SSL-busting adware: US cyber-plod open fire on Comodo's PrivDog
  "Essentially, Comodo's firewall and antivirus package Internet Security 2014, installs a tool called PrivDog by default. Some versions of this tool intercept encrypted HTTPS traffic to force ads into webpages. PrivDog, like the Lenovo-embarrassing Superfish, does this using a man-in-the-middle attack: it installs a custom root CA certificate on the Windows PC, and then intercepts connections to websites. Web browsers are fooled into thinking they are talking to legit websites, such as online banks and secure webmail, when in fact they are being tampered with by PrivDog so it can inject adverts. If that's not bad enough, PrivDog turns invalid HTTPS certificates on the web into valid ones: an attacker on your network can point your computer at an evil password-stealing website dressed up as your online bank, and you'd be none the wiser thanks to PrivDog."
  
• [2015-02-23] Psst, hackers. Just go for the known vulnerabilities
  "Every one of the top ten vulnerabilities exploited in 2014 took advantage of code written years or even decades ago, according to HP, which recorded an increase in the level of mobile malware detected. “Many of the biggest security risks are issues we’ve known about for decades, leaving organisations unnecessarily exposed,” said Art Gilliland, senior vice president and general manager, Enterprise Security Products, HP. “We can’t lose sight of defending against these known vulnerabilities by entrusting security to the next silver bullet technology; rather, organisations must employ fundamental security tactics to address known vulnerabilities and in turn, eliminate significant amounts of risk," he added."

[Chinese Virus Image, courtesy WatchChinaTimes.com]

• [2015-02-20] So long, Lenovo, and no thanks for all the super-creepy Superfish
  "Chinese PC maker Lenovo has published instructions on how to scrape off the Superfish adware it installed on its laptops – but still bizarrely insists it has done nothing wrong. That's despite rating the severity of the deliberate infection as "high" on its own website. Well played, Lenonope. Superfish was bundled on new Lenovo Windows laptops with a root CA certificate so it could intercept even HTTPS-protected websites visited by the user and inject ads into the pages. Removing the Superfish badware will leave behind the root certificate – allowing miscreants to lure Lenovo owners to websites masquerading as online banks, webmail and other legit sites, and steal passwords in man-in-the-middle attacks."
  
  
• [2015-02-15] Mozilla's Flash-killer 'Shumway' appears in Firefox nightlies
  "Open source SWF player promises alternative to Adobe's endless security horror. In November 2012 the Mozilla Foundation announced “Project Shumway”, an effort to create a “web-native runtime implementation of the SWF file format.” Two-and-a-bit years, and a colossal number of Flash bugs later, Shumway has achieved an important milestone by appearing in a Firefox nightly, a step that suggests it's getting closer to inclusion in the browser. Shumway's been available as a plugin for some time, and appears entirely capable of handling the SWF files."
  
  
• [2015-01-29] What do China, FBI and UK have in common? All three want backdoors...
  "The Chinese government wants backdoors added to all technology imported into the Middle Kingdom as well as all its source code handed over. Suppliers of hardware and software must also submit to invasive audits, the New York Times reports. The new requirements, detailed in a 22-page document approved late last year, are ostensibly intended to strengthen the cybersecurity of critical Chinese industries. Ironically, backdoors are slammed by computer security experts because the access points are ideal for hackers to exploit as well as g-men."
   
• [2015-01-15] Console hacker DDoS bot runs on lame home routers
  "Console DDoSers Lizard Squad are using insecure home routers for a paid service that floods target networks, researchers say. The service crawls the web looking for home and commercial routers secured using lousy default credentials that could easily be brute-forced and then added to its growing botnet. Researchers close to a police investigation into Lizard Squad shared details of the attacks with cybercrime reporter Brian Krebs. The attacks used what was described as a 'crude' spin-off of a Linux trojan identified in November that would spread from one router to another, and potentially to embedded devices that accept inbound telnet connections. High-capacity university routers were also compromised in the botnet which according to the service boasted having run 17,439 DDoS attacks or boots at the time of writing."

• [2014-12-14] CoolReaper pre-installed malware creates backdoor on Chinese Androids
  "Security researchers have discovered a backdoor in Android devices sold by Coolpad, a Chinese smartphone manufacturer. The “CoolReaper” vuln has exposed over 10 million users to potential malicious activity. Palo Alto Networks reckons the malware was “installed and maintained by Coolpad despite objections from customers”. It's common for device manufacturers to install software on top of Google’s Android mobile operating system to provide additional functionality or to customise Android devices. Some mobile carriers install applications that gather data on device performance. But CoolReaper operates well beyond the collection of basic usage data, acting as a true backdoor into Coolpad devices - according to Palo Alto.CoolReaper has been identified on 24 phone models sold by Coolpad."
  
  
• [2014-11-24] Regin: The super-spyware the security industry has been silent about
  "A public autopsy of sophisticated intelligence-gathering spyware Regin is causing waves today in the computer security world... On Sunday, Symantec published a detailed dissection of the Regin malware, and it looks to be one of the most advanced pieces of spyware code yet found. The software targets Windows PCs, and a zero-day vulnerability said to be in Yahoo! Messenger, before burrowing into the kernel layer. It hides itself in own private area on hard disks, has its own virtual filesystem, and encrypts and morphs itself multiple times to evade detection. It uses a toolkit of payloads to eavesdrop on the administration of mobile phone masts, intercept network traffic, pore over emails, and so on... Kaspersky's report on Regin today shows it has the ability to infiltrate GSM phone networks. The malware can receive commands over a cell network, which is unusual."
  

New Technology: 2012 December Update

SSD prices are low—and they'll get lower. MeRAM posed to supplant NAND flash memory...

IBM Integrates Optics onto Silicon...

Sun/Oracle receives patent 8,316,366 on Transactional Threading on November 2012... this came on the heels of a 2011 paper on formally verifying transactional memory on September 2011.

Silence has been from Sun/Oracle VLSI group on Proximity Communications, research funding is due to expire in 2013, is there a product in the future?

Samsung Spends $3.9bn on iPhone Chip Factory in Texas.

Texas Instruments to cut 517 OPAM Smartphone/Tablet Chip Manufacturing jobs in France.

AWS (Amazon Web Services) Hosting Server Retirement Notifications Wanting...

Microsoft Outlook 2013 Willfully Broken: Will Not Recognize .doc or .xls Files

Microsoft Windows 8: Hidden Backup & Clone Feature

Cisco / Linksys WRT610N and Management

Cisco / Linksys WRT610N and Management
Abstract:
Cisco's Linksys WRT610N is a consumer grade wireless router / access point which contains some higher-end features such as dual band, 5 port gigabit ethernet, and USB2 storage capabilities. When the device was released, the gigabit ethernet and dual-band capabilities were uncontested. Overall, for the price, it was a reasonable device, but some odd behaviors are exhibited.

Logging:
Network logging under the wrt610n was isolated to the network on the LAN interface and could not be forwarded to another network address. This means, centralized logging is impossible if one is trying to use this consumer grade product to provide unified support in an extended family situation, where different households need to be observed. Centralized administration (through a GUI) without centralized logging is pretty useless.

Fault, Performance, and Configuration Management:
With this device, you have some limited Configuration Management, but that is about it.
If you want to know whether a cable, port, or PC on you LAN port is experiencing errors due to something failing?- no way.
If you want to know what your consumption of network resources over your WAN connection to upgrade/downgrade your broadband - no way.
Want to know which device on your LAN is causing your VoIP phone service to degrade - no way.
Want to have your wireless router check into your own private Dynamic DHCP server, so you can help our your family members around the country when they have an problem - no way, unless you want their router name and ip to be broadcast to the rest of the world.
Want to detect viruses/worms infecting your PC's and pumping out tons of traffic, using up your WAN bandwidth - no way.
Want to detecting bots using your network to create a distributed denial service attack [resulting in the visit of local law enforcement] - no way.
Want to create a unified VPN network for your extended family, to share resources with privacy - no way.

Old Linksys VPN and VPN edge routers had some of these capabilites, without the wireless. The wrt610n was an expensive consumer device, with none of the useful features someone who would buy one of these would want. If you need real documented support, buy an old Cisco off of eBay (for less than you will buy this high-end consumer device) and configure it by hand using the following blog as an ADSL reference example.
You have to go with a real firmware from an alternate manufacturer, besides Cisco,  to do anything useful with this device, besides act as a gigabit switch. Unfortunately, because this high-end consumer item was fairly rare, most firmware providers consider the software beta, and some experiencing the proverbial "bricking" of their device.

Management Options:

SNMP Management:
Management via SNMP is unavailable. Early Linksys devices offered SNMP, but this is no longer. SNMP offers a safe way to view the configuration and performance performance characteristics of your router, but not with this high-end consumer device. This is a great disappointment, but there are some third-party firmware options.

Command Line Management:
Management via Telnet or SSH is unavailable. This allows fast access into a device, as well as being able to automate some basic operations, such as backing up configurations or collecting performance characteristics without SNMP. Unavailable, without going to a third-party firmware provider.

Web GUI Management:
Management via an HTTP or HTTPS web can be done via the LAN and the Wireless LAN. There is an option to administer the products over the internet, but this is pretty useless without the option of central logging outside of the LAN, SNMP, or command line interface.

Sure, you can wait until someone calls you to tell you the internet connection is flakey, but at that point, you better be prepare to drive to your family mambers house to read the logs locally or to help them navigate the web screen from their local web browser using the ip address.

Secret Web Management GUI:
There is a secret management GUI, where you can get some basic information about the device. Below is a small listing of available options. Many Telco and Bable providers will use the 192.168.1.x address range for their customer premesis terminations, so this following list will be applicable if you configured your Linksys device with a 192.168.3.1 ip address.

http://192.168.3.1/System.asp - Hidden Web Menu: Disable "Microsoft Vista" 6to4 multicast broadcasts
http://192.168.3.1/SysInfo.htm - Hardware Configuration (Vendor, Model, Serial, etc.)
http://192.168.3.1/SysInfo1.htm - RAM Counters: Total, Free, and Buffers
http://192.168.3.1/Cysaja.asp - Packet Counters: Transmit & Receive, both Good & Errors

These undocumented hidden menus can be used to get some of the basic information needed to understand the health of your network, no thanks to Cisco.

Strange Behaviors:
While trying to enable reasonable management of these high-end consumer level devices, one can expect various strange behaviors.

Junk Log Entries:
When logging is enabled, the logging machine would reflect a strange behavior - IPv6 packets would be constantly broadcasted, every 10 seconds, and getting logged! This will fill up the logs with useless data, making the logging facility pretty useless. This is related to IPv6 6to4 functionality.

sunsparc/user$ tail -f /var/adm/messages

Jul 3 14:02:53 wrt610n last message repeated 61 times
Jul 3 14:09:31 wrt610n klogd: IN=br0 OUT= MAC= SRC=fe80:0000:0000:0000:0221:29ff:febf:aaaa DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=96 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0

Jul 3 14:09:31 wrt610n last message repeated 64 times
Jul 3 14:16:16 wrt610n klogd: IN=br0 OUT= MAC= SRC=fe80:0000:0000:0000:0221:29ff:febf:aaaa DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=96 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0

Jul 3 14:16:16 wrt610n last message repeated 59 times
Jul 3 14:22:54 wrt610n klogd: IN=br0 OUT= MAC= SRC=fe80:0000:0000:0000:0221:29ff:febf:aaaa DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=96 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0

Jul 3 14:22:54 wrt610n last message repeated 62 times
Jul 3 14:29:33 wrt610n klogd: IN=br0 OUT= MAC= SRC=fe80:0000:0000:0000:0221:29ff:febf:aaaa DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=96 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0

Debugging Junk Logging:
Going through the standard menus is absolutely worthless.  There is no clue to show the user why their logging system is being filled up with absolute junk.

Eliminating Junk Logging:
Are you using IPv6? Well, if the answer is yes, then you are stuck with the horrible logging effects. No fix.

If you are not using IPv6, you can shut off the 6to4 protocol, using a secret menu. Oddly, a developer decided to blame his additional coding requirement on Microsoft, probably because Vista Premium support was placed on his firmware to-do list.

Use the secret "http://ipaddress.of.wrt610n.router/System.asp" menu, to "(X) Disable" the "Vista Premium" functionality. Be aware that when the "Save" button is pressed, the wireless access point will be rebooted. After the outage, be happy that the router will stop the packet creation and junk logging.

Large USB Drive Support:
Trying to attach 1.5TB external drive to the storage port was completely unsuccessful. Don't bother using the USB storage port for serious storage, it does not work well. There are now 4TB drives, I would not expect them to work. No fix.

USB sticks work pretty well, with an embedded FTP server. These have a much smaller capacity and slower to access than spinning disk, but that will change over time.
A stock Apple wireless access point with USB will be a more effective solution for storage. The newer Apple AirPort units offer gigabit ethernet in addition to dual-band now a days. At the time the WRT610N came out, no one offered these features, including Apple.

If USB storage is a requirements, the Apple wireless access point offers vastly more robust management from MacOSX, multiple USB drive support, sharing of mirrored disks in an external USB RAID enclosure, and even USB printing support as an added bonus.

DHCP Reservation:
The DHCP Reservation is able to be configured via "Setup -> Basic Setup -> DHCP Reservation" from the main administration GUI menu. The "Client Name" option can be set in the "Already Reserved" area - which provides for the ability to give a MAC Address an IP Address as well as a Name.

The problem with the Name? It is not used ANYWHERE. How about using the name in the DNS server or the other status menus? No fix.

Windows: Security Issues Again

Zero-Day Flaw in Windows Apps Since Early 2000's

Zero-Day Exploit:

A Zero-Day Exploit means that you turn-on or install software - you are vulnerable. Most PC's shipped applications bundled like MS Office on PC's, right out of the factory. Microsoft posted a security bulletin in April regarding some vulnerabilities.

Exploit Description:

The Register writes:

One of the four critical patches in the batch – MS12-027 – addresses an Active X issue that impacts numerous application and creates a mechanism to drop malware onto vulnerable Windows systems.

Microsoft warned of attacks in the wild against the zero-day flaw, which affects an unusually wide range of Microsoft products and Microsoft users. Applications affected include Office 2003 through 2010 on Windows; SQL Server 2000 through 2008 R2; BizTalk Server 2002; Commerce Server 2002 through 2009 R2; Visual FoxPro 8; and Visual Basic 6 Runtime.

And quotes:

"Attackers have been embedding the exploit for the underlying vulnerability CVE-2012-0158 into an RTF document and enticing the target into opening the file, most commonly by attaching it to an email," Wolfgang Kandek CTO at security services firm Qualys explains. "Another possible vector is through web browsing..."

Scope:

Basically, if you have a MS Windows platform with any Microsoft Application (i.e. Works, Office, Internet Explorer, etc.) - you are vulnerable... and Microsoft is warning users that attacks will begin to surge in the next 30 days, while people have not yet patched their system.

This thing has been around a decade, a facility provided by the OS, and embedded into applications on nearly every Windows based server and/or desktop on the internet. A patch is available now, but another issue recently uncovered will not be fixed until next month.

By the way, If you are a Windows, Apple, or Linux user - Adobe Acrobat Reader needs some patching, too.

If you are a Solaris client user, your system should be fine.


Nightmare Scenario:

We just discussed several days back about an Apple vulnerability due to a third-party Java exploit. This one is due to a competing Microsoft Technology called "Active-X".

Welcome to the proverbial nightmare scenario for network managers - every system, everywhere, must be patched immediately, because of OS based issues with nearly every business and consumer application. Don't delay!

Inevitable: Apple MacOSX Infected Via Java on Web

Inevitable: Apple MacOSX Infected via Java on Web

Abstract:
Desktop and Server based systems based upon Microsoft Windows platform have long been the most vulnerable platforms on the internet, providing the most efficient platform for malware writers to steal computing and network cycles from owners around the world. Various other open platforms (i.e. UNIX based systems), which serves much of the internet traffic, have long tried to keep from being infected, by applying more rigorous security rules at the OS level. Apple, being one such vendor who migrated to a UNIX platform, had been successful in keeping their clients secure - but finally a single Java based vulnerability has been discovered (and leveraged) to exploit some systems.

Virus Buster:
A virus vendor located in Russia recently published a short research article on a particular threat, which has been closed by Apple.

Doctor Web—the Russian anti-virus vendor—conducted a research to determine the scale of spreading of Trojan BackDoor.Flashback that infects computers running Mac OS X. Now BackDoor.Flashback botnet encompasses more than 550 000 infected machines, most of which are located in the United States and Canada. This once again refutes claims by some experts that there are no cyber-threats to Mac OS X.

While very uncommon, MacOSX based Apple Macintosh computers occasionally have third-party based software (i.e. Flash, Java, etc.) which can offer some level of vulnerability to all platforms, including MacOS, Windows, UNIX, etc.

The Origin:

The virus research company explains how computers get infected.

According to some sources, links to more than four million compromised web-pages could be found on a Google SERP at the end of March. In addition, some posts on Apple user forums described cases of infection by BackDoor.Flashback.39 when visiting dlink.com.

The Morphing:
Companies started working on a solution, but before Apple released a patch, there was an attempt to diversify the virus, so they might be able to survive once it was closed.

Attackers began to exploit CVE-2011-3544 and CVE-2008-5353 vulnerabilities to spread malware in February 2012, and after March 16 they switched to another exploit (CVE-2012-0507).

Security, At Last:
While this vulnerability has been "in the wild" on the internet for awhile, this particular virus was exterminated.

The vulnerability has been closed by Apple only on April 3, 2012.

Protecting Yourself:
This particular threat is not unique to Apple, but also other systems like Windows. Apple released a security patch, to close this vulnerability - it would be well advised that you regularly download updates from Apple to apply these patches whenever possible.

A general rule of thumb: STAY AWAY FROM IMMORAL (i.e. pornography) AND ILLEGAL (i.e. copyrighted material like music, videos, software, etc.) DOWNLOADS - NEVER VIEW OR DOWNLOAD SOFTWARE OFF OF THE INTERNET, UNLESS IT IS A WELL KNOWN SITE - NO MATTER WHAT COMPUTER YOU ARE ON... these sites notoriously try to download viruses to your computer!

Vonage and MSN Port Usage

Vonage and MSN Port Usage

Abstract:

Adding Voice over IP (VoIP) and Instant Messaging to a home is normally a simple process. The goal is often to increase communication while reducing telecommunications bills. Occasionally, there are problems with access, which required troubleshooting or more advanced features are desired. A user may need to understand the protocols, in order to better maintain security, and limit scope to attacks by viruses and worms.

Vonage Voice Adapters

Vonage is a low-cost VoIP phone provider service. Normally, not much needs to be done, except plug in a device. Here are the protocols which are required.

Service	TCP	UDP	Notes
DNS		53	Name Resolution
TFTP	21,69,2400		Firmware Upgrade
HTTP	80		Configuration
SIP		5061	pre-2005 Vonage devices
RTP		10000-20000	RTP (Voice) traffic

When a call is made, a random port between 10000 and 20000 is used for RTP (Voice) traffic. If any of these ports are blocked, you may experience one way or no audio.

Microsoft MSN and Windows Messenger

Microsoft provides various tools like MSN and Windows Messenger, but in order to get full functionality, occasionally users must forward ports through firewalls and expand exposure to worms and viruses. Use very carefully.

Service	TCP	UDP	Notes
Windows Messenger - voice		2001 - 2120 6801, 6901	Computer to Phone
MSN Messenger - file transfers	6891 - 6900		Allows up to 10 simultaneous transfers
MSN Messenger - voice	6901	6901	Voice communications computer to computer.
MSN Messenger text	1863		Instant text messages

The ports may be helpful when you want to limit vulnerabilities within your environment to unfriendly viruses and worms.

Virtualizations: LPARs, LDoms, Xen, KVM, VMWare, and HyperV

Virtualizations: LPARs, LDoms, Xen, KVM, VMWare, and HyperV

IBM LPARs
IBM LPARs is a premium proprietary virtualization technology which sits on top of IBM POWER architecture. It leverages the Virtual I/O Server (VIOS) in order to manage operating system resource requests from other domains.

https://www.ibm.com/developerworks/wikis/display/virtualization/VIO

"This allows a single machine to run multiple operating system (OS) images at the same time but each is isolated from the others. POWER4 based machines started this in 2001 by allowing many Logical Partitions (LPAR) to run on the same machine using but each using different CPUs, different memory sections and different PCI adapter slots. Next came with POWER4, the ability to dynamically change the CPU, memory and PCI adapters slots with the OS running. With the introduction of POWER5 in 2005, further Virtualization items have been added."

http://publib.boulder.ibm.com/infocenter/powersys/v3r1m5/index.jsp?topic=/iphb1/iphb1_vios_virtualioserveroverview.htm

"The Virtual I/O Server is software that is located in a logical partition. This software facilitates the sharing of physical I/O resources between client logical partitions within the server. The Virtual I/O Server provides virtual SCSI target, virtual fibre channel, Shared Ethernet Adapter, and PowerVM™ Active Memory Sharing capability to client logical partitions within the system. As a result, client logical partitions can share SCSI devices, fibre channel adapters, Ethernet adapters, and expand the amount of memory available to logical partitions using paging space devices. The Virtual I/O Server software requires that the logical partition be dedicated solely for its use. The Virtual I/O Server is part of the PowerVM Editions hardware feature."

SPARC LDOM's or Oracle VM for SPARC
SPARC LDOM's (or now referred to as Oracle VM for SPARC) is analagous to IBM's LPARs. IBM's VIOS appears to be analagous to Control Domain under. The LDom Control Domain can be subdivided between Control, Service, and I/O Domains - to architect redundancy and additional performance in a SPARC platform. LDom's are a free Solaris SPARC bundled virtualization technology.

http://www.oracle.com/us/technologies/virtualization/oraclevm/oracle-vm-server-for-sparc-068923.html

"Oracle VM Server for SPARC (previously called Sun Logical Domains) provides highly efficient, enterprise-class virtualization capabilities for Oracle's SPARC T-Series servers. Oracle VM Server for SPARC allows you to create up to 128 virtual servers on one system to take advantage of the massive thread scale offered by SPARC T-Series servers and the Oracle Solaris operating system. And all this capability is available at no additional cost."

http://en.wikipedia.org/wiki/Logical_Domains

"The Control domain, as its name implies, controls the logical domain environment. It is used to configure machine resources and guest domains... The control domain also normally acts as a service domain. Service domains present virtual services, such as virtual disk drives and network switches, to other domains… Current processors can have two service domains in order to provide resiliency against failures. I/O domain has direct ownership of and direct access to physical I/O devices, such as a network card in a PCI controller… Control and service functions can be combined within domains."

There are basic technologies available through LDOM's to developers and architects such as cluster-in-a-box, redundant I/O domains, etc.
http://docs.oracle.com/cd/E19316-01/820-4676/ggtcs/index.html

"In this logical domains (LDoms) guest domain topology, a cluster and every node within that cluster are located on the same Solaris host. Each LDoms guest domain node acts the same as a Solaris host in a cluster. To preclude your having to include a quorum device, this configuration includes three nodes rather than only two."

Xen
There are some similarities to the way these former hypervisors and Xen is architected. Various implementations of Xen exist, such as Citrix Hypervisor, Oracle VM for x86, and OpenSolaris based Xen (now a project under Illumos.) Xen is an open-sourced hypervisor.

http://xen.org/files/Marketing/WhyXen.pdf

"A critical benefit of the Xen Hypervisor is its neutrality to the various operating systems. Due to its independence, Xen is capable of allowing any operating system (Linux, Solaris, BSD, etc) to be the Domain0 thereby ensuring the widest possible use case for customers. For example, many hardware manufacturers leverage NetBSD as their OS of choice for Domain0 and are able to deploy Xen in the manner of their choosing."

"This separation of hypervisor from the Domain0 operating system also ensures that Xen is not burdened with any operating system overhead that is unrelated to processing a series of guests on a given machine. In fact, more are beginning to break up the Domain0 from a single guest into a series of mini-OS guests each with a specific purpose and responsibility which drives better performance and security in a virtualization environment."

KVM
No, this is not a Keyboard switch. Late to the game was a Linux and OpenSolaris based virtualization technology, unfortunately called KVM, for Kernel Virtual Machine. First implemented under Linux.
http://wiki.linuxplumbersconf.org/_media/2010:02-lpc-kvmstoragestackperformance.pdf

Modern OS features such as DTrace and ZFS are now available to KVM after it was quickly ported to OpenSolaris source code base by Joyent for their Open Source SMARTOS cloud operating system and cloud offering
http://www.phoronix.com/scan.php?page=news_item&px=OTc5Ng

"Joyent has announced today they have open-sourced their SmartOS operating system, which is based on Illumos/Solaris. Additionally, this cloud software provider has ported the Linux KVM (Kernel-based Virtual Machine) to this platform.

Being derived from Illumos and in-turn from Solaris, SmartOS does ship with ZFS support, DTrace, and other former Sun Microsystems technologies."

Microsoft HyperV
Some vendors came very late to the hypervisor game. Microsoft HyperV have a similar architecture, available only under Intel & AMD processors, depend on hardware acceleration available under only certain CPU chips from both of those vendors.


VMWare ESXi
VMWare has a great deal of experience in hypervisors, growing out of a software-driven solution, before hardware handlers became popular (and leveraged) in the Intel/AMD world. They provide some of the best backwards-compatibility in the Intel/AMD world.

Microsoft Phone: Reaction to iPhone

Microsoft Phone: Reaction to Apple iPhone

Abstract:
Microsoft failing in the consumer/mobile arena. With operating systems like Windows CE, it is no wonder. Microsoft may finally have a winning mobile system. The innovation forced upon them was a reaction driven by Apple's wildly successful iPhone.

What's New:
Microsoft and Nokia is about to release, at 2012 International Consumer Electronics Show, in Las Vegas, Nevada, USA. Nokia's new phone is described as a sleek metallic phone. The Lumia 900 sports a Microsoft Windows mobile operating system and will be sold by AT&T in the United States.

Is it enough?
With Nokia killing it's home-grown phone operating system and Microsoft taking a front-seat in software development for Nokia, this could be a two-headed monster or an elegant solution desired by everyone. Consumers will make this decision over the next year.

RIM: Unbelievably Down, Unbelievably Long

RIM: Unbelievably Down, Unbelievably Long
Abstract:

Sun had a saying "The Network is The Computer". When a network is down, the computer is nearly useless. RIM is now experiencing "The Network is The BlackBerry". The BlackBerry is pretty much useless without the network. The impact to the market may be terrible.

A Short History:

Apple had made an attempt to build a "Personal Digital Assistant" market in 1987. The "Newton" seemed to target educators and students. Some other vendors released competing products, but none of them seem to be successful. It was a product "before it's time".

In 1996, U.S. Robotics created the "Palm Pilot", new digital assistant. This became successful, the technology moved to 3Com, Handspring, Palm.

Nokia started the merging of personal digital assistant software into the phone in the late 1990's, later on with some weak web browsing capability. Nokia cobbled together their phone with HP's software. The term "smart phone" was created. Ericson released a concept PDA and phone in 1997 with the eventual culmination of a touchscreen "smartphone" in 2000. The phone used the SymbianOS.


[2008-2009 Market Trend]

RIM seems to have virtually created the "smart phone" market in 1999. The merging of digital personal assistant and cell phone seemed to drive their success. Their primary target community was business and financial segments, who could afford an uplifted phone cost for the side benefit of becoming more efficient. The product offering was a success.


[2006-2009 Market Trend]

In the early 2000's, Palm released a merged their personal digital assistant with cell phone technology. The "smart phone" market had a new competitor. Eventually, the technology was purchased by HP, where it resides today.

[2009-2010 Market Trend]

Apple computer started designing the iPhone in 2005 and released it in January 2007. Their new "smart phone" (i.e. iPhone), which was speculated to be a "flop" since it did not come with a keyboard. The product targeted the "creative" and "youth" segments, merging functionality from their wildly popular iPod portable music & video playing devices. Also bundled was the first real web browser - until this point, internet HTTP experience was poor. The product offering was a success and placed pressure on RIM by slowly intruding into the business and financial sectors, while other vendors (like Palm and Microsoft) were getting devastated.


[2010-2011 Market Trend]

Google started a parallel track to Apple. They purchased Android, Inc in late 2005 and eventually released an operating system called "Android" in late 2007, after the wildly successful Apple iPhone introduction earlier that year. Phone manufacturers jumped on-board Android, trying to get a chunk of the "smart phone" market, without the heavy investment and innovation performed by companies like Palm, RIM, and Apple.


Cell phone giant, Nokia, had been losing market share. Microsoft had been losing marketshare in the mobile phone operating system market. These two shrinking titans agreed in April 2011 to combine forces - Nokia providing hardware with Microsoft's OS. It could stem the bleeding from both companies or the two shrinking titans might become one sinking titanics.

The Nightmare Scenario

RIM had "secret sauce" embedded into it's BlackBerry communicator - all communciation from their phones were carried over their network infrastructure, in addition to the telephone carrier's infrastructure. RIM's encrypted network allowed them to provide add-on services, as well as security to their business users.

This week, there has been a multi-day outage for BlackBerry users, across the globe. The problem was with a switch in THEIR INFRASTRUCTURE - which means it is not the fault of a telephone company. Only BlackBerry users are affected - while the rest of the SmartPhone market is unaffected.

Don't Lie To The Customer

RIM's "secret sauce" is appearing to be their "achilles heel". Without RIM and their network, the BlackBerry is pretty much useless.

This very week, there is BlackBerry training happening in my corporate headquarters, and when questions regarding the BlackBerry difficulties came up - the trainer said "there must be something wrong with your company's network."

The truth is not only out, but it appears the issue is isolated to THEIR customer network.

Bad Discusssions

When investors and analysts start to talk about situations like these, the language does not get any worse than this.

Jefferies analyst Peter Misek crushed RIM in a research note today. His memo to activists was that RIM's turnaround will take a long time...

Specifically, Misek said that RIM can't be broken up until its migration to QNX is complete in roughly six months. Meanwhile, a management change is difficult. Motorola Mobility CEO Sanjay Jha would be a candidate to lead RIM, but he's highly thought of at Google. Other executives at Apple and Microsoft are largely locked up from going to RIM. PC makers, smartphone rivals, and other takeover options look slim.

Add it up and RIM's only real option at the moment is to execute well and bolster momentum for the BlackBerry. The outages aren't helping that cause.

Surviving because there are no other options on the table when investors are thinking about chopping your comany up into little pieces it not a good place to be.


When Sharks Attack

During this very week, Apple had announced their long-anticipated iPhone 4S, a faster SmartPhone with build-in "Cloud Syncronization" - Apple will no longer require a user to have a computer in order to keep their phones backed up or syncronized with music. Apple's phone will no longer require Apple or a PC in order to get the full functionality of it. Apple's open-sourced MacOSX based iPhone was poised for serious growth, without the BlackBerry disaster.

Google is about to feed the market, with it's army of hardware manufacturers, with more open-sourced Android phones while sinking-faster-than-a-brick Nokia and Microsoft are trying to establish a new marketplace with Microsoft's closed-source operating system. Microsoft, with their business relationships, may actually float Nokia, with this unfortunate BlackBerry disaster.

This will surely be a feeding frenzy for the three major remaining phone operating system vendors.


Bad for the Free Market

The Free Market is all about choice - the loss of any major competitor in the market is bad for all of the consumers.

One might argue that RIM's "monopoly" of providing THE centralized infrastructure for all BlackBerries to traverse is the due penalty for their anti-capitalistic tendencies... and their customers deserve what they get for placing all their "eggs in one basket".

This author is not interested in seeing the diverse market competitors become centralized, since the evil is self-evident, it is dangerous for innovation. There must be freedom to innovate in the highly government regulated market of telecommunications.

Network Management

The probable decline of RIM is due to one massive network infrastructure error.

Had their network been better managed, their future decline may not be so sure.

It is possible that they will recover, but I would hate to be in that company today, and I would hate to be the team managing that network today.

The network is the rise and fall of a company - don't mis-manage your network.

Citrix: XenApp and MS SQL Express

Citrix: XenApp and MS SQL Express

Abstract:

Citrix XenApp Platinum with SmartAuditor comes shipped with an embedded Microsoft SQL Database. Microsoft removed the backup agent from the MS SQL Express 2005, even though it was bundled in former Express releases. There are alternatives to the stock backup capability that Microsoft stripped from their MS SQL Express.

Documentation:

Microsoft provides some best practies backup and restoral of their database. Microsoft published such notes on the Microsoft Deveoper Network, or MSDN for short.

[MSDN Managing Database Files (SQL Server Express)] - Microsoft published a note about managing database files under Microsoft SQL Server Express 2008R2 release. Similar notes for 2005 and 2008 editions were also included.

[MSDN Deploying SQL Server Express] - This technican note deployment of MS SQL Server Express from 2008 and on, including a tool called "xcopy". Versions 2008, 2008R2, and the next release (i.e. Denali) are all noted.

[MSDN How To: Attach a Database File to SQL Server Express ] - This note discusses attaching a database file, from a backup, to a Microsoft SQL Server Express installation. Versions include: 2005, 2008, 2008R2. and Denali.

[MSDN SQL Server 2008R2 Backup Overview] - This note includes a link to Recovery Model Overview. An additional note points to Creating Full and Differential Backups of an SQL Database. An additional note on Working with Transaction Logs is also referenced.

[MS Developer Network Backups] - In May of 2008, Jonathan Kehayias posted an article on Microsoft Developers Network with a stored procedure and basic usage of the procedure in order to perform backups and restorals. The article is not clear on performing restorals.

[MSDN Backup Transact-SQL] - Microsoft published a technical note on how to conduct various backups of Microsoft SQL Server. The article is not clear on performing restorals. After doing some searches, there was a similar Restore Transact-SQL note.

[MSDN How To Restore a Database Backup] - This note discussed how to conduct a restore using Microsoft SQL Server Management Studio.

[MSDN Backing Up and Restoring Databases] - This note is explicitly for SQL Server.

[MSDN Copying Databases to Other Servers] - This note is explictly for SQL Server.

Alternatives:

Over the internet, many common people lamented the problem with Microsoft yanking the agent involved in scheduling database backups from SQL Server Express starting from 2005 version. Various people took different approaches.

[DB-Save SQL Server Backup] - A robust German solution which will not only backup and restore, but allow for restoral onto other systems. DBSave says it is optimised for "SQL Server newbies". It is available in freeware and commercial editions. Encryption and compression are both available. One databases supported via freeware. Backup to FTP Server supported. Scheduled jobs are not available in freeware edition. See Feature Matrix.

[SQL Backup and FTP] - A simple solution which will backup and restore up SQL databases. It is available in freeware and commercal editions. Compression is available. Two databases are supported via freeware. Backup to FTP Server is supported in freeware edition. See Features Matrix.

[SQL Agent: A .NET Framework] - Danilo Corallo published a piece of code on May 2008 that provide the yanked Job Scheduling feature and runs as a Microsoft Service.

[SQL Server Nation SQL Server Express Automation ] - Tim Chapman published a suggestion on how to backup SQL Server Express databases using a script and the Microsoft Windows 2008R2 Scheduler.

[BrianMadden Automate Backup of SQL Server 2005 Express] - Katie Koepke in May 2007 published an article on backing up the embedded database in Citrix.

Conclusion:

Microsoft has really put the screws to new users of their embedded database technology by removing the most basic of features and not clearly documenting a simple path for backup and restore.

Remembering Korn, Windows, and UNIX

If you don't know who David Korn is, he is the creator of the Korn Shell or "ksh".

This short interview with David Korn is required reading for all blog followers.

A classic piece of computing history from a UNIX/Microsoft Conference:

It was at a USENIX Windows NT conference and Microsoft was presenting their future directions for NT. One of their speakers said that they would release a UNIX integration package for NT that would contain the Korn Shell.

I knew that Microsoft had licensed a number of tools from MKS so I came to the microphone to tell the speaker that this was not the "real" Korn Shell and that MKS was not even compatible with ksh88. I had no intention of embarrassing him and thought that he would explain the compromises that Microsoft had to make in choosing MKS Korn Shell. Instead, he insisted that I was wrong and that Microsoft had indeed chosen a "real" Korn Shell. After a couple of exchanges, I shut up and let him dig himself in deeper.

Finally someone in the audience stood up and told him what almost everyone in the audience knew, that I had written the 'real' Korn Shell. I think that this is symbolic about the way the company works.

A seasoned systems architect, helping people understand Microsoft Windows.

My experience is with the WIN32 API for the core OS and not with the WIN32 interface to the GUI. Clearly I had to learn more about the WIN32 API than I think that anyone should need to know. The more I know about the WIN32 API the more I dislike it. It is complex and for the most part poorly designed, inconsistent, and poorly documented.

One of the biggest myths about Windows is that the MS operating systems are compatible, unlike UNIX which has so many variants. In reality, porting from one version of Windows to another is often more difficult than porting from one UNIX or Linux system to another. WIN32 calls on one system are not necessarily implemented on other systems, or even worse, they behave differently, requiring completely different code strategies.

That is not to say that there aren't things that I like about Windows NT. The handle model is good, but would have been better if Microsoft had done it right. The separation of dynamic libraries into interface and implementation also makes sense. Putting the libraries in the same directory as the executables is an improvement over UNIX since the allows executables and libraries to be searched for simultaneously

The best advice I can give is to not use Windows unless you have to, or if you have to, use a UNIX operating system on top of Windows like UWIN or Cygwin.

Another notable quote, helping people understand what UNIX really is.

There are many people who use UNIX or Linux who IMHO do not understand UNIX. UNIX is not just an operating system, it is a way of doing things, and the shell plays a key role by providing the glue that makes it work. The UNIX methodology relies heavily on reuse of a set of tools rather than on building monolithic applications. Even perl programmers often miss the point, writing the heart and soul of the application as perl script without making use of the UNIX toolkit.

Deleting a locked partition table with Windows XP

Partition tables are lockable, for instance GUID Partition Tables (GPT) will do this, and even though you can see that the disk is attached and activated you may not be able to format it or see its contents. When using Windows XP, if you no longer need the data, the easiest way to get around this is to use the default installed tool DiskPart.exe to remove the disk's Master Boot Record(MBR).

From the XP desktop:
go to Start> Run...> cmd

C:\>diskpart

Microsoft DiskPart version 5.1.3565 Copyright (C) 1999-2003 Microsoft Corporation.
On computer: Microsoft Windows XP [Version 5.1.2600]

DISKPART> list disk

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 37 GB 0 B
Disk 1 Online 34 GB 0 B
Disk 2 Online 34 GB 0 B
Disk 3 Online 34 GB 0 B
Disk 4 Online 34 GB 0 B
Disk 5 Online 34 GB 0 B
Disk 6 Online 34 GB 0 B
Disk 7 Online 34 GB 0 B
Disk 8 Online 34 GB 0 B

DISKPART> select disk 8

Disk 8 is now the selected disk.

DISKPART> clean

DiskPart succeeded in cleaning the disk.

DISKPART> exit

The disk is now ready to format.

Microsoft Windows: The Target of Nearly All Malware

Microsoft Windows: The Target of Nearly All Malware

The Known

A short article from The Register delineates the concern for data centers.

The vast majority of malware - more than 99 per cent - targets Windows PCs, according to a new survey by German anti-virus firm G-Data.

G-Data reckons 99.4 per cent of all new malware of the first half of 2010 targeted Microsoft’s operating system.

Some would suggest that this is not news, but an understanding of what is already known.

The Predicted

With the increase of Windows viruses and worms up, the trend is expected to get much worse.

G-Data reckons the rate of virus production in 1H10 is 50 per cent up from the same period last year. It predicts 2010 as a whole will witness two million malware samples.

What is a Network Operation Center to do?

The Smart Road

Any reasonable Network Operation Center knows that exposing Microsoft Windows directly to other customer networks and directly to other supplier networks is an incredible security risk.

There are ways to mitigate that risk.

G-Data reckons the rate of virus production in 1H10 is 50 per cent up from the same period last year. It predicts 2010 as a whole will witness two million malware samples.

Deploying Microsoft Windows on customer and supplier facing networks is a risk that should be avoided when nearly all of the risk can be eliminated by deploying another operating system.

If mission critical software has to run in a business, the software runs under Solaris.

Itanium: The Death of Microsoft Windows Support

Itanium: The Death of Microsoft Windows Support

Announcement:

In December of 2009, it was reported that Red Hat Linux started the process of ceasing support for Intel Itanium processors. Now, it appears that Microsoft is starting it's process of discontinuing support for Intel Itanium.

History:

See former blog entry when Red Hat Linux discontinued their Itanium support.

Network Management Implications:

None. There were no serious Network Management products using Microsoft Windows on Itanium. There are really only HP operating systems left on this CPU platform, a single isolated software vendor on a single isolated chip supplier.

Why Few Implications:

Single vendor processors (IBM POWER and Intel Itanium) are somewhat more risky, when there is a gap in the development cycle due to human error. Specialized software vendors looking for longevity often look for multiple suppliers when producing a product, to ensure that a single vendor glitch does not damage their product marketing.

In the areas of server processors, there really only seems to be two multi-vendor CPU vendors left: SPARC (Oracle/Sun and Fujitsu) and x64 (Intel and AMD.)

Who Will Be Affected?

Probably, the people who will be most affected by this move will be businesses who depended on Microsoft SQL Server on Itanium.

Had those vendors chosen another database vendor, who supports multiple architectures (i.e. Oracle RDBMS) - a migration to another Operating System (i.e. an HP Operating System) on the same hardware could have been done, to extend the life of the asset, and any desired hardware architecture could have been chosen to migrate to later (i.e. SPARC, POWER, Intel x64, AMD x64.)