Showing posts with label Windows. Show all posts
Showing posts with label Windows. Show all posts

Monday, December 3, 2018

Oracle Ends Microsoft Windows Platform Support

Oracle Ends Microsoft Windows Platform Support

Abstract:

Sun Microsystems had branched out into Intel Support, even as far as alternate operating systems, to gain market share. For awhile, Sun was #3 in servers shipped. Oracle had purchased Sun Microsystems, advanced the SPARC processors, to make the fastest servers in the world, running Solaris. This occurred, as Oracle continued to advance Intel based Engineered Systems. Microsoft Windows was a key native platform support for Intel Oracle hardware.
[Microsoft Windows Logo, courtesy seeklogo.net ]

Oracle Orphans Windows on Intel Based Bare Metal:

Oracle had discontinued Intel Hardware Management support for Microsoft Windows on the their Intel based chassis. As per their note:
Note - Oracle Hardware Management Pack version 2.3.8 is the last release of Oracle Hardware Management Pack to include support for the Microsoft Windows operating system.
August 2018 Release Notes for Oracle Hardware Management Pack version 2.4 clearly states that it has removed Microsoft Windows Support.
Removed support for the Microsoft Windows operating system. Oracle Hardware Management Pack version 2.3.8 is the last version to support Microsoft Windows.



Windows on Oracle's Bare-Metal Servers will no longer be a best-practice in datacenters.


[Solaris Logo, courtesy Sun Microsystems]

Oracle Solaris on SPARC & Intel Lives On

The Oracle Hardware Management Pack has become integrated & delivered in Oracle Solaris 11 releases, directly from Oracle. It has been bundled in 11.2, 11.3, and now 11.4 - from the very first releases of the operating systems. Support for Oracle Solaris on Oracle Hardware lives on!




Conclusions:

The push seems to be on to push Microsoft Windows off of native hardware support on Oracle Intel based systems. If there is a desire to properly manage an OS on Oracle bare metal, Microsoft Windows is not a good choice, from a lifecycle management perspective. Solaris and Linux are best-practices. While Oracle Linux is a best practice under Intel, Solaris is a best-practice both under SPARC and Intel.





Tuesday, March 31, 2015

Security: 2015q1 Concerns

Viruses, Worms, Vulnerabilities and Spyware concerns during and just prior 2015 Q1.

  • [2015-03-07] Litecoin-mining code found in BitTorrent app, freeloaders hit the roof
    "μTorrent users are furious after discovering their favorite file-sharing app is quietly bundled with a Litecoin mining program. The alt-coin miner is developed by distributed computing biz Epic Scale, and is bundled in some installations of μTorrent, which is a Windows BitTorrent client. Some peeps are really annoyed that Epic's code is running in the background while they illegally pirate torrent movies and Adobe Creative Suite Linux ISOs, and say they didn't ask for it to be installed."

  • [2015-03-06] FREAKing HELL: All Windows versions vulnerable to SSL snoop
    "Microsoft has confirmed that its implementation of SSL/TLS in all versions of Windows is vulnerable to the FREAK encryption-downgrade attack. This means if you're using the firm's Windows operating system, an attacker on your network can potentially force Internet Explorer and other software using the Windows Secure Channel component to deploy weak encryption over the web. Intercepted HTTPS connections can be easily cracked, revealing sensitive details such as login cookies and banking information, but only if the website or service at the other end is still supporting 1990s-era cryptography (and millions of sites still are)."

  • [2015-03-05] Broadband routers: SOHOpeless and vendors don't care
    "Home and small business router security is terrible. Exploits emerge with depressing regularity, exposing millions of users to criminal activities. Many of the holes are so simple as to be embarrassing. Hard-coded credentials are so common in small home and office routers, comparatively to other tech kit, that only those with tin-foil hats bother to suggest the flaws are deliberate."
  • [2015-03-05] Obama criticises China's mandatory backdoor tech import rules
    "US prez Barack ‪Obama has criticised China's new tech rules‬, urging the country to reverse the policy if it wants a business-as-usual situation with the US to continue. As previously reported, proposed new regulations from the Chinese government would require technology firms to create backdoors and provide source code to the Chinese government before technology sales within China would be authorised. China is also asking that tech companies adopt Chinese encryption algorithms and disclose elements of their intellectual property."
  • [2015-03-05] Sales up at NSA SIM hack scandal biz Gemalto
    "Sales at the world's biggest SIM card maker, Gemalto, which was last month revealed to have been hacked by the NSA and GCHQ, rose by five per cent to €2.5bn (£1.8bn) in 2014. Following the hack, the company's share price fell by $470m last month. In February, it was revealed that the NSA and Britain's GCHQ had hacked the company to harvest the encryption keys, according to documents leaked by former NSA sysadmin, whistleblower Edward Snowden."

  • [2015-02-24] SSL-busting adware: US cyber-plod open fire on Comodo's PrivDog
    "Essentially, Comodo's firewall and antivirus package Internet Security 2014, installs a tool called PrivDog by default. Some versions of this tool intercept encrypted HTTPS traffic to force ads into webpages. PrivDog, like the Lenovo-embarrassing Superfish, does this using a man-in-the-middle attack: it installs a custom root CA certificate on the Windows PC, and then intercepts connections to websites. Web browsers are fooled into thinking they are talking to legit websites, such as online banks and secure webmail, when in fact they are being tampered with by PrivDog so it can inject adverts. If that's not bad enough, PrivDog turns invalid HTTPS certificates on the web into valid ones: an attacker on your network can point your computer at an evil password-stealing website dressed up as your online bank, and you'd be none the wiser thanks to PrivDog."
  • [2015-02-23] Psst, hackers. Just go for the known vulnerabilities
    "Every one of the top ten vulnerabilities exploited in 2014 took advantage of code written years or even decades ago, according to HP, which recorded an increase in the level of mobile malware detected. “Many of the biggest security risks are issues we’ve known about for decades, leaving organisations unnecessarily exposed,” said Art Gilliland, senior vice president and general manager, Enterprise Security Products, HP. “We can’t lose sight of defending against these known vulnerabilities by entrusting security to the next silver bullet technology; rather, organisations must employ fundamental security tactics to address known vulnerabilities and in turn, eliminate significant amounts of risk," he added."

[Chinese Virus Image, courtesy WatchChinaTimes.com]
  • [2015-02-20] So long, Lenovo, and no thanks for all the super-creepy Superfish
    "Chinese PC maker Lenovo has published instructions on how to scrape off the Superfish adware it installed on its laptops – but still bizarrely insists it has done nothing wrong. That's despite rating the severity of the deliberate infection as "high" on its own website. Well played, Lenonope. Superfish was bundled on new Lenovo Windows laptops with a root CA certificate so it could intercept even HTTPS-protected websites visited by the user and inject ads into the pages. Removing the Superfish badware will leave behind the root certificate – allowing miscreants to lure Lenovo owners to websites masquerading as online banks, webmail and other legit sites, and steal passwords in man-in-the-middle attacks."

  • [2015-02-15] Mozilla's Flash-killer 'Shumway' appears in Firefox nightlies
    "Open source SWF player promises alternative to Adobe's endless security horror. In November 2012 the Mozilla Foundation announced “Project Shumway”, an effort to create a “web-native runtime implementation of the SWF file format.” Two-and-a-bit years, and a colossal number of Flash bugs later, Shumway has achieved an important milestone by appearing in a Firefox nightly, a step that suggests it's getting closer to inclusion in the browser. Shumway's been available as a plugin for some time, and appears entirely capable of handling the SWF files."

  • [2015-01-29] What do China, FBI and UK have in common? All three want backdoors...
    "The Chinese government wants backdoors added to all technology imported into the Middle Kingdom as well as all its source code handed over. Suppliers of hardware and software must also submit to invasive audits, the New York Times reports. The new requirements, detailed in a 22-page document approved late last year, are ostensibly intended to strengthen the cybersecurity of critical Chinese industries. Ironically, backdoors are slammed by computer security experts because the access points are ideal for hackers to exploit as well as g-men."
     
  • [2015-01-15] Console hacker DDoS bot runs on lame home routers
    "Console DDoSers Lizard Squad are using insecure home routers for a paid service that floods target networks, researchers say. The service crawls the web looking for home and commercial routers secured using lousy default credentials that could easily be brute-forced and then added to its growing botnet. Researchers close to a police investigation into Lizard Squad shared details of the attacks with cybercrime reporter Brian Krebs. The attacks used what was described as a 'crude' spin-off of a Linux trojan identified in November that would spread from one router to another, and potentially to embedded devices that accept inbound telnet connections. High-capacity university routers were also compromised in the botnet which according to the service boasted having run 17,439 DDoS attacks or boots at the time of writing."
  • [2014-12-14] CoolReaper pre-installed malware creates backdoor on Chinese Androids
    "Security researchers have discovered a backdoor in Android devices sold by Coolpad, a Chinese smartphone manufacturer. The “CoolReaper” vuln has exposed over 10 million users to potential malicious activity. Palo Alto Networks reckons the malware was “installed and maintained by Coolpad despite objections from customers”. It's common for device manufacturers to install software on top of Google’s Android mobile operating system to provide additional functionality or to customise Android devices. Some mobile carriers install applications that gather data on device performance. But CoolReaper operates well beyond the collection of basic usage data, acting as a true backdoor into Coolpad devices - according to Palo Alto.CoolReaper has been identified on 24 phone models sold by Coolpad."

  • [2014-11-24] Regin: The super-spyware the security industry has been silent about
    "A public autopsy of sophisticated intelligence-gathering spyware Regin is causing waves today in the computer security world... On Sunday, Symantec published a detailed dissection of the Regin malware, and it looks to be one of the most advanced pieces of spyware code yet found. The software targets Windows PCs, and a zero-day vulnerability said to be in Yahoo! Messenger, before burrowing into the kernel layer. It hides itself in own private area on hard disks, has its own virtual filesystem, and encrypts and morphs itself multiple times to evade detection. It uses a toolkit of payloads to eavesdrop on the administration of mobile phone masts, intercept network traffic, pore over emails, and so on... Kaspersky's report on Regin today shows it has the ability to infiltrate GSM phone networks. The malware can receive commands over a cell network, which is unusual."




Tuesday, December 25, 2012

New Technology: 2012 December Update


SSD prices are low—and they'll get lower. MeRAM posed to supplant NAND flash memory...

IBM Integrates Optics onto Silicon...

Sun/Oracle receives patent 8,316,366 on Transactional Threading on November 2012... this came on the heels of a 2011 paper on formally verifying transactional memory on September 2011.

Silence has been from Sun/Oracle VLSI group on Proximity Communications, research funding is due to expire in 2013, is there a product in the future?

Samsung Spends $3.9bn on iPhone Chip Factory in Texas.

Texas Instruments to cut 517 OPAM Smartphone/Tablet Chip Manufacturing jobs in France.

AWS (Amazon Web Services) Hosting Server Retirement Notifications Wanting...

Microsoft Outlook 2013 Willfully Broken: Will Not Recognize .doc or .xls Files

Microsoft Windows 8: Hidden Backup & Clone Feature

Monday, December 24, 2012

Security: 2012 December Update


Microsoft Windows Security Update Breaks Fonts... Update 2753842 Root Cause...
Breaking Windows Passwords in under 6 hours...

New "Dexter" Malware Infects Microsoft Point of Sale Systems to Steal Credit Cards...

Distributed Denial of Service Attacker Anonymous on the Run...

The Pakistan Cyber Army Attacks Chinese and Bangladeshi Web Sites...

ITU: Deep Packet Snooping Standard Leak...

Democrats and Republicans Unite Against ITU Internet Control...

Industrial HVAC systems targeted by hackers...

Microsoft Internet Explorer watching you, even when not open on your screen!

Android Malware Trojan Taints US Mobiles, Spews 500,000 Texts A Day!

 Baby got .BAT: Old-school malware terrifies Iran with del *.*; dubbed BatchWiper; found 7 months after Flame discovery

Apple Shifts iTunes to HTTPS, Sidesteps China’s Firewall

Christopher Chaney, Scarlett Johansson's e-mail hacker, sentenced to 10 years

Wednesday, April 11, 2012

Windows: Security Issues Again


Zero-Day Flaw in Windows Apps Since Early 2000's

Zero-Day Exploit:

A Zero-Day Exploit means that you turn-on or install software - you are vulnerable. Most PC's shipped applications bundled like MS Office on PC's, right out of the factory. Microsoft posted a security bulletin in April regarding some vulnerabilities.

Exploit Description:

The Register writes:

One of the four critical patches in the batch – MS12-027 – addresses an Active X issue that impacts numerous application and creates a mechanism to drop malware onto vulnerable Windows systems.

Microsoft warned of attacks in the wild against the zero-day flaw, which affects an unusually wide range of Microsoft products and Microsoft users. Applications affected include Office 2003 through 2010 on Windows; SQL Server 2000 through 2008 R2; BizTalk Server 2002; Commerce Server 2002 through 2009 R2; Visual FoxPro 8; and Visual Basic 6 Runtime.
And quotes:

"Attackers have been embedding the exploit for the underlying vulnerability CVE-2012-0158 into an RTF document and enticing the target into opening the file, most commonly by attaching it to an email," Wolfgang Kandek CTO at security services firm Qualys explains. "Another possible vector is through web browsing..."
Scope:

Basically, if you have a MS Windows platform with any Microsoft Application (i.e. Works, Office, Internet Explorer, etc.) - you are vulnerable... and Microsoft is warning users that attacks will begin to surge in the next 30 days, while people have not yet patched their system.

This thing has been around a decade, a facility provided by the OS, and embedded into applications on nearly every Windows based server and/or desktop on the internet. A patch is available now, but another issue recently uncovered will not be fixed until next month.

By the way, If you are a Windows, Apple, or Linux user - Adobe Acrobat Reader needs some patching, too.

If you are a Solaris client user, your system should be fine.


Nightmare Scenario:

We just discussed several days back about an Apple vulnerability due to a third-party Java exploit. This one is due to a competing Microsoft Technology called "Active-X".

Welcome to the proverbial nightmare scenario for network managers - every system, everywhere, must be patched immediately, because of OS based issues with nearly every business and consumer application. Don't delay!

Saturday, April 7, 2012

Inevitable: Apple MacOSX Infected Via Java on Web


Inevitable: Apple MacOSX Infected via Java on Web

Abstract:
Desktop and Server based systems based upon Microsoft Windows platform have long been the most vulnerable platforms on the internet, providing the most efficient platform for malware writers to steal computing and network cycles from owners around the world. Various other open platforms (i.e. UNIX based systems), which serves much of the internet traffic, have long tried to keep from being infected, by applying more rigorous security rules at the OS level. Apple, being one such vendor who migrated to a UNIX platform, had been successful in keeping their clients secure - but finally a single Java based vulnerability has been discovered (and leveraged) to exploit some systems.

Virus Buster:
A virus vendor located in Russia recently published a short research article on a particular threat, which has been closed by Apple.

Doctor Web—the Russian anti-virus vendor—conducted a research to determine the scale of spreading of Trojan BackDoor.Flashback that infects computers running Mac OS X. Now BackDoor.Flashback botnet encompasses more than 550 000 infected machines, most of which are located in the United States and Canada. This once again refutes claims by some experts that there are no cyber-threats to Mac OS X.
While very uncommon, MacOSX based Apple Macintosh computers occasionally have third-party based software (i.e. Flash, Java, etc.) which can offer some level of vulnerability to all platforms, including MacOS, Windows, UNIX, etc.

The Origin:

The virus research company explains how computers get infected.

According to some sources, links to more than four million compromised web-pages could be found on a Google SERP at the end of March. In addition, some posts on Apple user forums described cases of infection by BackDoor.Flashback.39 when visiting dlink.com.
The Morphing:
Companies started working on a solution, but before Apple released a patch, there was an attempt to diversify the virus, so they might be able to survive once it was closed.

Attackers began to exploit CVE-2011-3544 and CVE-2008-5353 vulnerabilities to spread malware in February 2012, and after March 16 they switched to another exploit (CVE-2012-0507).
Security, At Last:
While this vulnerability has been "in the wild" on the internet for awhile, this particular virus was exterminated.

The vulnerability has been closed by Apple only on April 3, 2012.
Protecting Yourself:
This particular threat is not unique to Apple, but also other systems like Windows. Apple released a security patch, to close this vulnerability - it would be well advised that you regularly download updates from Apple to apply these patches whenever possible.

A general rule of thumb: STAY AWAY FROM IMMORAL (i.e. pornography) AND ILLEGAL (i.e. copyrighted material like music, videos, software, etc.) DOWNLOADS - NEVER VIEW OR DOWNLOAD SOFTWARE OFF OF THE INTERNET, UNLESS IT IS A WELL KNOWN SITE - NO MATTER WHAT COMPUTER YOU ARE ON... these sites notoriously try to download viruses to your computer!

Tuesday, March 20, 2012

Mobile Update: Android and Windows


Mobile Update: Android and Windows

Abstract:

Developers in an ecosystem will often foretell adoption by creating content to drive demand for a product. The mobile market has been gauged by this same phenomenon.

Developers and Android:

While the chart is not linear (a mistake, not to create this as a time-series graph), it seems to show some very interesting trends. Developer interest in Android has appeared to have peaked and declining under both phones and tablets; interest in iPhone development is showing an ever so slight decline; iPad holding steady; interest in Windows mobile is inclining; BlackBerry dropping like a proverbial stone.


People have been commenting that the wrong statistics are getting followed, it is not happening, marketshare is not accurate, etc. - but there seems to be a slight discontent with the Android market from a developer's standpoint.

This is not the entire story - Android has a terrific price point, marketshare grows for Android at an astounding rate (as we will see shortly.) There is still some level of comfort that developers and consumers have with iOS, but one can never know how long that will last for - the marketplace is fickle.

Windows Clunky & Crashy:

While Windows for mobile devices seems to be catching more developers market share, it still looks very clunky, during various demonstrations. Note the multiple [thick] cabling hanging off of the tablet on the left, one with what seems to be an ugly adapter... one would not be surprised if all those cables place a great deal of strain on the tablet connectors and reduce longevity. They certainly reduce the ability to use the tablet in a free-flowing way. If I was presenting at Convergence 2012, I would not want to use that device.


The worst possible thing happened (again) when Microsoft was presenting at Convergence 2012 - a crash and burn of their new tablet.


You've got to hand it to Kirill Tatarinov, the head of Microsoft's ERP division. The Russian Rocket was cool as a cucumber on Monday when a demo of the Windows 8 Metro UI running on a touch-screen tablet crashed and burned during the opening keynote of Convergence 2012.

Sometimes, one has to feel bad for these presenters. having done multiple demos in the past, it is not very fun to have something like this happen, but it is not uncommon for Microsoft. It does not get any better, once you have a conference facility filled with people, networking at it's capacity peak, and power being drawn on a massive scale.


Windows Sinking, Android Skyrocketing:

Last year, this time, Microsoft mobile handset users experienced crashing on a massive scale, with a patch. Under 1 year later, mobile Windows handset sales collapsed while Android skyrocketed with what appears to be brand-new marketshare. Apple continued to make measured, but modest gains.



Network Management Connection:

Wired infrastructure is critical, but it seems to quickly becoming relegated to back-office. Front-office work moved towards laptops (which started outselling PC's in 2003, 2005, 2008), which often had wireless built-in for mobility. The trend continues to move mobile with smart phones and tablets. The previous Gartner marketshare chart (not the percentages) tells all: increase in overall units from 81 million units sold to 115 million units sold in 1 year in the 3rd quarter!

Wireless is THE PLACE to be, in the network management world. If you do not have a grasp on your wireless network, you need to figure out how to do so. People are clearly becoming unteathered, regardless of what the Microsoft Mobile presenters are doing, with their tethered and crashing tablets.

Tuesday, January 10, 2012

Microsoft Phone: Reaction to iPhone


Microsoft Phone: Reaction to Apple iPhone

Abstract:
Microsoft failing in the consumer/mobile arena. With operating systems like Windows CE, it is no wonder. Microsoft may finally have a winning mobile system. The innovation forced upon them was a reaction driven by Apple's wildly successful iPhone.

What's New:
Microsoft and Nokia is about to release, at 2012 International Consumer Electronics Show, in Las Vegas, Nevada, USA. Nokia's new phone is described as a sleek metallic phone. The Lumia 900 sports a Microsoft Windows mobile operating system and will be sold by AT&T in the United States.

Is it enough?
With Nokia killing it's home-grown phone operating system and Microsoft taking a front-seat in software development for Nokia, this could be a two-headed monster or an elegant solution desired by everyone. Consumers will make this decision over the next year.

Sunday, January 8, 2012

Windows 8: Getting More ZFS'ish


Windows 8: Getting More ZFS'ish

Abstract:
Storage has always been a part of operating systems. Over time, storage capabilities have increasingly became more sophisticated in operating systems, consuming features from 3rd party partners. Occasionally, a vendor will release very sophisticated increments to their operating systems. Windows 8 is projected to receive more ZFS-like features, to make it more competitive with Solaris, when Sun release ZFS over a half-dozen years ago.


History:
Intel based systems had relied upon a file system referred to as FAT since the late 1970's. Systems during this time period occasionally offered only upper case characters, FAT was case insensitive. During the 1980's, FAT16 was released, to deal with larger hard drives. The 1990's saw the introduction of FAT32, to deal with longer file names. These file system were, for the most part, primitive - targeting floppy disks and hard disks, identifying physical storage through a letter of the alphabet.

Microsoft, the key Intel based operating system vendor, promised an Object Oriented file system during the 1990's and a Relations Database filesystem during the 2000's. Both of these projects were canceled, with an interim file system called NTFS, to drag users out of the proverbial stone ages. NTFS was too proprietary bound to the Microsoft operating system) and too heavy to bring to portable storage devices, like camera flash cards and USB flash sticks, which still carry the baggage of the ancient FAT file system.

Most UNIX systems included file system management bound to individual disks during the late 60's and into the early 1970's, but they quickly moved to a virtual file system, allowing disks to be added (mounted) anywhere in a single tree, transparent to the applications. During the 1980's, Sun Microsystems extended this abstraction to virtualize the file system to network based devices, as well as physical devices. Third-Party vendors, like Veritas, created Logical Volume Management systems with their own third-party file systems, to consolidate multiple physical disks into a single virtualized physical device.

Sun Microsystems introduced in 2005 the first major advancement in file system technology, in decades. Gone was the forcing of users to use separate drive letters of DOS and NTFS to desgnate physical devices; gone was separate volume management system to virtualized multiple physical devices into a seeing device; gone was separate file system layer to sit on top of a virtual or physical device. ZFS was created to take operating systems into the next decade, with aspects consolidating a hybrid 64-128 bit internal structures.

Windows 8 Storage Spaces:
Microsoft quietly announced new features in a Windows 8 Beta via a blog post. The Register published a short article regarding Storage Spaces.
Microsoft will introduce in Windows 8 what it calls
Storage Spaces – a method of putting drives into a
virtual pool from which self-healing virtual disks
can be created, with some resemblance to ZFS features.

Details of these virtual disks – the aforementioned
Storage Spaces – were described in a 4,400-word
deep-dive blog poston Thursday, introduced by
Microsoft Windows Division head, Steven Sinofsky,
and written by a member of Redmond's Storage
and File System team, Rajeev Nagar.
How robust will the new system be, if it is released in Windows 8 Beta?
Storage Spaces is somewhat like ZFS, although it has no
deduplication and lacks other ZFS features. However, it is
a start – and Microsoft will probably add features such as
snapshots, replication, deduplication, and, maybe, compression.
The Register posted an article where Open Source OpenSolaris based Nexenta discusses Windows 8 Storage Spaces.
Windows 8 Storage Spaces papers over some previous
shortcomings, but does not solve a limit on the total
TB that a file system can store, which is 16TB. It
still lacks double or triple parity RAID, which means
your data is at risk since the odds of two failures
on a RAID group, and data loss, increases with large
drives that take more time to rebuild. There is also
no ability to snapshot and replicate your data.
Finally, there is no end-to-end data integrity -
there’s nothing like the cryptographic-strength
256 bit checksums of ZFS-based solutions like NexentaStor.
Analysis:
Will Microsoft's new Storage Spaces be able to displace NTFS or even FAT, or will Storage Spaces find itself in the company of former Microsoft Object or Relational file systems? This question will be ultimately answered in 10 more years.

Microsoft has a long history of trying to innovate and failing in storage. Microsoft has a long way to catch up. With virtually unlimited resources derived from a PC monopoly and constant inbound royalties from ancient FAT - they can not be counted out.

Network Management:
What will be the impact on Network Management? Nothing, if Storage Spaces follows other storage advancements.

Will Microsoft implement it's storage technologies with management extensions directly to SNMP, to make it truely network friendly?

Microsoft has the possibility to take leadership away from new ZFS owner, Oracle, on the Internet, if true SNMP management is taken into consideration. If not, Microsoft will be left a half-dozen year in the rears, continuing to play catch-up with the market leader.

Tuesday, May 24, 2011

Remembering Korn, Windows, and UNIX



If you don't know who David Korn is, he is the creator of the Korn Shell or "ksh".

This short interview with David Korn is required reading for all blog followers.

A classic piece of computing history from a UNIX/Microsoft Conference:


It was at a USENIX Windows NT conference and Microsoft was presenting their future directions for NT. One of their speakers said that they would release a UNIX integration package for NT that would contain the Korn Shell.

I knew that Microsoft had licensed a number of tools from MKS so I came to the microphone to tell the speaker that this was not the "real" Korn Shell and that MKS was not even compatible with ksh88. I had no intention of embarrassing him and thought that he would explain the compromises that Microsoft had to make in choosing MKS Korn Shell. Instead, he insisted that I was wrong and that Microsoft had indeed chosen a "real" Korn Shell. After a couple of exchanges, I shut up and let him dig himself in deeper.

Finally someone in the audience stood up and told him what almost everyone in the audience knew, that I had written the 'real' Korn Shell. I think that this is symbolic about the way the company works.
A seasoned systems architect, helping people understand Microsoft Windows.

My experience is with the WIN32 API for the core OS and not with the WIN32 interface to the GUI. Clearly I had to learn more about the WIN32 API than I think that anyone should need to know. The more I know about the WIN32 API the more I dislike it. It is complex and for the most part poorly designed, inconsistent, and poorly documented.

One of the biggest myths about Windows is that the MS operating systems are compatible, unlike UNIX which has so many variants. In reality, porting from one version of Windows to another is often more difficult than porting from one UNIX or Linux system to another. WIN32 calls on one system are not necessarily implemented on other systems, or even worse, they behave differently, requiring completely different code strategies.

That is not to say that there aren't things that I like about Windows NT. The handle model is good, but would have been better if Microsoft had done it right. The separation of dynamic libraries into interface and implementation also makes sense. Putting the libraries in the same directory as the executables is an improvement over UNIX since the allows executables and libraries to be searched for simultaneously

The best advice I can give is to not use Windows unless you have to, or if you have to, use a UNIX operating system on top of Windows like UWIN or Cygwin.


Another notable quote, helping people understand what UNIX really is.
There are many people who use UNIX or Linux who IMHO do not understand UNIX. UNIX is not just an operating system, it is a way of doing things, and the shell plays a key role by providing the glue that makes it work. The UNIX methodology relies heavily on reuse of a set of tools rather than on building monolithic applications. Even perl programmers often miss the point, writing the heart and soul of the application as perl script without making use of the UNIX toolkit.

Tuesday, March 22, 2011

Detecting & Obscuring Tethering



Detecting & Obscuring Tethering


Abstract:
Network providers have traditionally offered the capability of leveraging the wireless network for portable computers. Recently, certain wireless devices had been omitted from this capability called Tethering. The Apple iPhone may leverage a particular TCP/IP feature called Time To Live (TTL) which may be leveraged to track tethering.

Enter Julian 3:
A user who refers to himself as "Julian 3" who reads "The Register" in the UK posted a comment indicating one way which a mobile device may be differentiated from other mobile devices, as well as how to determine if that device is performing tethering. Julian 3 explains TTL in this fashion:
All IP packets have something called a TTL associated with them. It stands for Time To Live. Every "hop" along the network from one router to the next reduces the TTL by one. When it reaches 0, the packet is dropped. This was introduced to keep routing problems from overloading the network. If for example, by some error a packet was going around in a circular path, the TTL would eventually reach 0 and prevent a packet storm.
Julilan 3 suggests that the iPhone uses a TTL of 64 and packets from tethered devices may normally have a different TTL from the packets which originate from their devices. After the packets proceed through the iPhone, acting as a gateway, the TTL in the packet will decrease by one.

Suggested Obfuscation:

Julian 3 suggests the following process to obscure Windows clients.
Apple uses a TTL of 64 for the iPhone, by the way. So change the TTL on your computer to "65" and there should be no problem. Here's how to do it:

1. Click Start - Search and type “regedit”. This launches the WIndows Registry.

2. In the registry, navigate to the following registry key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] HKEY_LOCAL_MACHINE
\SYSTEM
\CurrentControlSet
\Services
\Tcpip
\Parameters

3. In the right pane, right-click and select New – DWORD (32-bit value) and set its name as "DefaultTTL" and set its value anything between 0 and 255. The value sets the number of Hops or links the packet traverses before being discarded.
Network Management Connection:
This process of detecting a tethered connection is very network centric. Whether or not a network carrier uses this particular process for tethering is really not important. It does demonstrate that various signatures from a client can be used to easily determine characteristics about the source system.

There are plenty of other mechanisms which can be used to identify the source or destination of traffic, including simple things like HTTP headers. Fully obscuring the source system is far more complex than this.

Tuesday, September 14, 2010

Microsoft Windows: The Target of Nearly All Malware




Microsoft Windows: The Target of Nearly All Malware

The Known

A short article from The Register delineates the concern for data centers.

The vast majority of malware - more than 99 per cent - targets Windows PCs, according to a new survey by German anti-virus firm G-Data.

G-Data reckons 99.4 per cent of all new malware of the first half of 2010 targeted Microsoft’s operating system.

Some would suggest that this is not news, but an understanding of what is already known.

The Predicted

With the increase of Windows viruses and worms up, the trend is expected to get much worse.
G-Data reckons the rate of virus production in 1H10 is 50 per cent up from the same period last year. It predicts 2010 as a whole will witness two million malware samples.
What is a Network Operation Center to do?

The Smart Road

Any reasonable Network Operation Center knows that exposing Microsoft Windows directly to other customer networks and directly to other supplier networks is an incredible security risk.

There are ways to mitigate that risk.
G-Data reckons the rate of virus production in 1H10 is 50 per cent up from the same period last year. It predicts 2010 as a whole will witness two million malware samples.
Deploying Microsoft Windows on customer and supplier facing networks is a risk that should be avoided when nearly all of the risk can be eliminated by deploying another operating system.

If mission critical software has to run in a business, the software runs under Solaris.

Friday, August 20, 2010

McAfee: Purchased by Intel After Fiasco


McAfee: Purchased by Intel After Fiasco

What is Virus Protection?

Operating Systems like Microsoft Windows offers mechanisms to install software automatically. Sometimes, it the mechanism is a bug. Other times, it is a key which may have been purchased or hacked, and later leveraged to deposit viruses or spy-ware. Sometimes, the OS just offers too much freedom to the user, to allow them to install anything they would like (anywhere they would like), and when they unwittingly install a piece of software on purpose, the machine becomes infected.

Some consider it the computing system equivalent to the Mafia, "You want to be safe, pay us some protection money, and you'll be safe." They work to make the computing environment more rigid because the operating system vendor (in this case, Microsoft) was too lazy.

To make the environment more rigid, inspection is done for known snips of code on files loaded on the hard drive, coming in or out via email, or through tools like web browsers. These pieces of code that are searched for, basically subets of the possible virus or worms which can be used to identify them, are called "signatures".

The "signatures" are distributed from central locations from the Mafia's God Father to the software applications which some people choose to install on their computer, hereafter referred to as the Hitman. It is the job of the Hitman on your computer to whack the virus... or regularly encourage you to pay-up if you did not pay your security bill.

Leading up to the Acquisition:

Less than half a year ago, McAfee distributed a virus signature update that identified a core Microsoft Windows file a problem and whacked it.
McAfee update crippled some Windows PCs by quarantining or deleting a file crucial to Windows operation, called “svchost.dll”.

The bug, McAfee said, meant that “less than half of one per cent” of business customers, and a smaller number of consumer customers, could not use their computers. The company did not release any detailed figures, but said that the problem nly occurred on machine running Windows XP Service Pack 3 in combination with a specific build of McAfee’s antivirus product.
Large segments of society, especially emergency services who were unfortunate enough to pick Microsoft Windows for their core infrastructure, in combination with McAfee, and various service packs were scrambling for cover.
Reported victims include Kansas City Police Department and and the University of Kansas Hospital and about a third of the hospitals in Rhode Island. PCs also went haywire at Intel, the New York Times reports, citing Twitter updates from workers at the chip giant as a source.

First hand experiences from an Iowa community emergency response centre, ironically running a disaster recovery exercise at the time, can be found in a posting to the Internet Storm Centre here. The Register has heard from a senior security officer at a net infrastructure firm that was also hard hit by the snafu, as reported in our earlier story here.

McAfee picked up very bad reputation after this event.

To be fair, a virus signature is nothing more than a pattern of bits that can appear in a file at a particular set of locations, so it is amazing that after all these years, with so many virus signature creators, that this has not happened earlier.

The New God Father:

After a very bad spring and summer, the cost of the help desk support to repair all of those old machines, lost customers who would stop using their products, bad media coverage from the mishap, and new customers who were not very interested in taking a chance on them - someone else was really needed to clean up their reputation.

Intel Corporation made purchased McAfee. What surprises me is that fewer media outlets had connected the purchase with the recent virus signature failure.

Network Management Connection:

Microsoft Windows systems are tremendous targets for viruses and worms. With Network Management systems which must be located in a DMZ and connect to millions of potential end points, such platforms should be considered a virus & worm distribution system, and avoided.

The application of virus definitions to such production systems can disrupt the reputation of a third party management company and put them out of business, the same way McAfee tarnished reputation needed to be consumed by Intel.

Monday, April 5, 2010

Itanium: The Death of Microsoft Windows Support



Itanium: The Death of Microsoft Windows Support

Announcement:


History:

See former blog entry when Red Hat Linux discontinued their Itanium support.

Network Management Implications:

None. There were no serious Network Management products using Microsoft Windows on Itanium. There are really only HP operating systems left on this CPU platform, a single isolated software vendor on a single isolated chip supplier.

Why Few Implications:

Single vendor processors (IBM POWER and Intel Itanium) are somewhat more risky, when there is a gap in the development cycle due to human error. Specialized software vendors looking for longevity often look for multiple suppliers when producing a product, to ensure that a single vendor glitch does not damage their product marketing.

In the areas of server processors, there really only seems to be two multi-vendor CPU vendors left: SPARC (Oracle/Sun and Fujitsu) and x64 (Intel and AMD.)

Who Will Be Affected?

Probably, the people who will be most affected by this move will be businesses who depended on Microsoft SQL Server on Itanium.

Had those vendors chosen another database vendor, who supports multiple architectures (i.e. Oracle RDBMS) - a migration to another Operating System (i.e. an HP Operating System) on the same hardware could have been done, to extend the life of the asset, and any desired hardware architecture could have been chosen to migrate to later (i.e. SPARC, POWER, Intel x64, AMD x64.)