Well, it looks like this might become a regular feature - quickies on Friday that is!

Please Check out my new Article

If you are interested in seeing some of my new writing attempts, you can visit here and read: PC Security is Your Business!

http://smallbizbee.com/index/2008/11/21/pc-security-business/

(Ethical Truth: I’m also in a writing contest and if I have the most unique page hits in 24-hours I win $100. Help a sister out and click the link!)

My Good Morning News

I also had a rough morning and felt pretty bad because sometimes I don’t think people are reading what I write. Then this morning I received notice of 3 comments on the recent Botnet blog entry! (See: What Ad Server is Dishing up Malware and Bots?) That was VERY encouraging to me.

But I also have to share two posts I received from my students this morning.  This added icing on the blog comments cake!

(Note: The names and email addresses had to be blurred to protect the students annonymity.)

Student Comment

I about cried when I read that and it was so awesome to get this morning!

Then, another student responded to this post with this:

Student Response

How can anyone’s day go bad with e-mail like that!!!! Wow! I’m so honored and feeling so good!

Update on the Botnet Alerts

If you read the comments from others at the blog post - What Ad Server is Dishing up Malware and Bots?) - there are others reporting in with the same problem.

There has been no word to me directly from anywhere about what this is.  Trend Micro has not responded, the ad servers have not responded, and no one on my LinkedIn group has even suggested what it might be (they usually don’t!).

Not that I expect Trend, Google, Right Media, Yahoo, or any of the rest to contact me. But heck Trend Micro could comment on what the heck this is! Sigh.

Anyway, people are reporting this activity on all kinds of sites.

• Tarot.com
• Business Week
• Yahoo
• Yahoo Mail
• Reuters
• The Register

Just to name a few. The one thing they all have in common is ads!

Lee’s comment suggests we all add the following BLOCK URL’s:

http://iacas.adbureau.net

http://partner.googleadservices.com

Thanks LEE!

Late Breaking News

Now I’m told by my twitter friend, that the Pentagon just banned USB devices due to a virus outbreak. How does that happen? Good gosh, don’t get me started!

Folks, I think we have a problem, right here in Internet City. Ok, that’s a bad play on words from the Music Man song. But I am VERY SERIOUS. Or, as the saying goes, I’m as serious as a heart attack!

I’m greatly disturbed by something that’s happening repeatedly and with great regularity!

Every morning I go to a website: tarot.com to read my horoscope and other tidbits of information. My housemate visits there too on weekend mornings.

First, let me preface this by saying that over the past several months, tarot.com has added a slew of Google ads (adsense) and other ad delivery services to their site. Their site content is free so I do understand the need to generate income, believe me I do!

The reason I’m telling you this is because there seems to be a direct correlation between the amount of ad content and the quickly spreading malware that we are seeing recently.

Just now, as I’m writing this, I received a call from another person that told me the same thing happened to him on Yahoo Mail. I immediately went to Yahoo and received the exact same pop-up message again! This botnet thing - whatever it is - is disabling the Antivirus programs too!

Last weekend, while at tarot.com my housemate received the dreaded Antivirus 2009 pop-up message while visiting their site. Of course, he knows how to exit that without becoming infected with the Trojan, and I alerted their support immediately. They said they would investigate. To date, I have not received that particular message and I’ve heard nothing further from the folks at Tarot.com.

This morning, I’m visiting there and I get my Trend RUbotted pop-up stating that a bot was found.

(Click to view larger image)

So, I immediately close my browser and start the scans. Here’s the interesting part, every scan came up negative.

(Click to view larger image)

(Click to view larger image)

And even my RUBotted log doesn’t even acknowledge a threat! WHAT????

(Click to view larger image)

I even went so far as to scan with Trend’s online Housecall! And no threats found. WTF?

(Click to view larger image)

Now, I shut down - totally shut down because something is deeply wrong here.

I boot to the following problem with TrendMicro Internet Security Pro:

(Click to view larger image)

My Trend is disabled and I cannot restart it.

Now I run Spybot Search and Destroy. I only find a few measly cookies in Firefox and a bad saved bookmark that I didn’t know was dangerous!

(Click to view larger image)

Now I’m perplexed! What in the heck is going on????

Now, I run a wireshark packet capture and I go back to Yahoo Mail to see if I can duplicate the bot message. And sure enough! There it is again!

But this time, I have an IP address!

150.70.89.33

WhoIS says this:

OrgName:    Asia Pacific Network Information Centre
OrgID:      APNIC
Address:    PO Box 2131
City:       Milton
StateProv:  QLD
PostalCode: 4064
Country:    AU

So now I go to the Whois for APNIC (http://wq.apnic.net/apnic-bin/whois.pl) and find this on the IP:

inetnum:      150.26.0.0 - 150.100.255.255
netname:      JAPAN150
country:      JP
descr:        Japan Network Information Center
admin-c:      JNIC1-AP
tech-c:       JNIC1-AP
status:       ALLOCATED PORTABLE
notify:       hostmaster@nic.ad.jp
mnt-by:       MAINT-JPNIC
changed:      hm-changed@apnic.net 20070824
source:       APNIC

role:         Japan Network Information Center
address:      Kokusai-Kougyou-Kanda Bldg 6F, 2-3-4 Uchi-Kanda
address:      Chiyoda-ku, Tokyo 101-0047, Japan
country:      JP
phone:        +81-3-5297-2311
fax-no:       +81-3-5297-2312
e-mail:       hostmaster@nic.ad.jp
admin-c:      JI13-AP
tech-c:       JE53-AP
nic-hdl:      JNIC1-AP
mnt-by:       MAINT-JPNIC
changed:      hm-changed@apnic.net 20041222
changed:      hm-changed@apnic.net 20050324
changed:      ip-apnic@nic.ad.jp 20051027
source:       APNIC

Surprise, surprise! Japan is at it again!

So, now I’m peeved to say the least. Bastages!

I grabbed the Yahoo mail page source code and the Tarot.com source code. There has to be something duplicated between these two pages that are displaying the same ad code that is allowing this to get in. What is it?

Looking at both pages, I found the advertising code and Tarot.com is using DoubleClick (ad.doubleclick.com) while Yahoo is using the ad.yieldmanager.com which, after research I tracked down to Right Media.

The tarot.com ad code:

(Click to view larger image)

The Yahoo Mail page ad code:

(Click to view larger image)

I typed in yieldmanager.com since the ad.yieldmanager.com is a sub-domain of yieldmanager.com and I received this result:

(Click to view larger image)

So, I went to the right media site and it turns out yieldmanager is a Yahoo company! Imagine that?

(Click to view larger image)

So, here’s what I did. I blocked ad.yieldmanager.com in my Firefox cookies and I blocked ad.doubleclick.net.

(Click to view larger image)

You can also do the same in IE if you are using that. If you need directions on how to do this, contact me.

Now, here’s my take on this situation. There is one of several, if not all of the following situations going on here. The possibilities are:

• The same malware creator is advertising on all the advertising networks so (s)he can push the malware.
• All the ad servers have been compromised.
• All the ad servers have been injected with a code that will serve up this malware.

Either way you look at it, it appears that the advertising networks are clueless that they are putting all users at risk in their effort to generate revenue.

If you would like a copy of my wireshark packet capture files please contact me and I’ll send them to you.

If you are an advertising network and you would like testing done on your servers, please contact us to get a quote for those services. We do penetration testing - remotely and on-site.

If you are a antivirus, malware, or firewall software provider and would like all our files, please contact us. (Please note that our forensic files are not given unless we receive acknowledgment for our findings. That includes our partners: Trend Micro and Symantec.)

And to those of you who are STILL NOT USING IT, I highly suggest getting the FREE botnet tool from TrendMicro located here: http://www.trendsecure.com/portal/en-US/tools/security_tools/rubotted

Your PC Security is ultimately your responsibility! None of these manufacturers are going to come and clean up your machine for you. You’re stuck cleaning up the mess after they fail to protect you. So, I would suggest you start protecting yourself and learning how to do that!

ADDED: 2:30 PM CTD, Business Week just gave me one!

(Check it out at your own risk! http://images.businessweek.com/ss/08/10/1023_btw/index.htm)

With the holiday season so close, I wanted to share this site with you in case you are looking for Santa to bring you a laptop!

http://www.laptopcodes.com/

Haven’t tried it myself, but there are coupon codes for the various laptop manufacturers!

Happy shopping!

I’m really supposed to be doing something else right now, but I couldn’t let this post wait.

At first, I thought there was a mistake due to an article I caught on CNET which said, “WSJ calls Microsoft antivirus tool ’spyware’.“ Because I thought the Wall Street Journal knew what I’ve been saying all this time!

Microsoft NEVER does anything with the users best interest in mind. There has to be some kind of spying capacity in this new thing.

But alas, the article actually refers to a graphic that was presented on the WSJ front page and of course, trying to read the freaking article on WSJ (which is a garbage piece of supposed financial journalism anyway) is impossible since they want you to subscribe to their overpriced pro Republican conservative call it a newspaper.

I actually had a Google alert waiting for me in my gmail inbox which gave me the scoop.

In a Press Release titled: Microsoft Announces Plans for No-Cost Consumer Security Offering the release states that Microsoft is ending the sales of OneCare. (Should’ve made bets on that one! DARN!)

But it also announced that since Microsoft has such an award winning malware engine (first, I never heard of any of the companies giving the awards, and secondly, wtf????), and it’s so concerned about the spread of malware and its users (Yeah, right! I believe that - NOT!), it’s going to offer this great, free solution that suckers - I mean consumers - will just want to use.

My questions to Microsoft:

1. How much is this software going to phone home with user information?

2. What data are you going to be collecting?

3. What’s in it for you (because we all know you don’t do anything without some kind of profit in it for you)?

Am I jaded? Ya think???

Lock down your PC’s folks. I’m sure this piece of fine Microsoft software will come in on a critical  auto-update! After all, does their piece of crap Malicious Software Removal Tool come in as a critical update? (I might be wrong on that one.)

Anyway, just a heads up that you’ll probably be marketed to by the brilliant minds at Microsoft to download this new piece of junk, or it will be downloaded for you.  Either way, beware of geeks bearing gifts - especially if the geeks are named Microsoft!

My GOD, I can’t learn Ubuntu soon enough!

UPDATED ADDENDUM: I just found this post from a CNET guru who claims that this is supposed to create a problem for major vendors like Symantec, Trend Micro and the like.  Sorry dude, but I have to disagree with you. Anyone with an ounce of brains in their head will never trust Microsoft with their security!

First of all, the malware creators will find a way around it, just as they have every stinking piece of M$ unsecure software.

Secondly, Microsoft has proven to the world of users that they cannot be trusted. Even if they were the next best thing since sliced bread in the Antivirus market, our recent experience with Vista alone and the lies we’ve been told about it is enough to make me vomit - let alone not trust them.

Lastly, how can anyone expect to trust Microsoft with anything security when they’ve proven they don’t know squat about it! LOOK AT THEIR SOFTWARE DUDE! IT’S NOT SECURE!

If you can’t make a secure piece of software to save your soul, why would anyone believe they know a damn thing about security???? Get serious!

Give me a solid, secure, piece of your software, and then maybe, just maybe I’ll reconsider. Until then, forget about it.

Over the past several weeks, I’ve noticed my feed subscribers on the right side go up and down, then up and then down again.

All the while, I couldn’t figure out what the heck was going on!

Well, it’s official. All of my feeds and all our client feeds have been moved to the Google Feed interface. Google purchased feedburner quite some time ago and it was only a matter of time.

Supposedly, if you subscribe to us, you shouldn’t have to change anything. It is supposed to automatically update your feed reader (through a redirect).

This particular blog is officially updated. Now, on to updating the many, many clients we have! A webmaster’s work is never done!

If you have problems understanding the new feeds and what needs to be changed, please contact us and we will be happy to assist you.

More interesting stuff to come soon……

I was on the phone with my one of our instructors, Anthony Valente from Network Defense Solutions, discussing a problem with one of clients’ Debian servers. Eventually, the conversation led into Microsoft’s push into open source.

I made the comment to Anthony that I didn’t understand why Microsoft was pumping so much money into Novell’s SUSE Linux when I just read the about OSLO and Midori, two upcoming offerings from Microsoft. Couple those two with the Eclipse project and you’ve got Microsoft doing some pretty “open source” sounding activities.

I said, “If Microsoft is leaning more toward the open source, I don’t think they’re trying to push Novell’s Linux to compete with Ubuntu.”

Anthony brought up a very interesting point that I actually missed but makes sense!

He said, “Microsoft isn’t leveraging Novell because of their Linux! Think about it. Novell has their network security software in the enterprise for a long time - Netware. They’re pushing into Novell to compete with Cisco!”

I never really thought about that, but now that Anthony brought it up, it seems rather logical. I was thinking that Microsoft was pumping money into the Novell certificates for Linux so they can keep a strong market presence in the Linux and open source market. Everyone is so peeved with Microsoft and the failed Vista - that Ballmer is now claiming wasn’t really meant to be a new operating system in the first place - that many more users are going toward Ubuntu. (Me included!)

In an August 25, 2008 NetworkWorld.com article, John Fontana titled: Microsoft invests more in Novell, Fontana states:

The two vendors claim the $100 million investment is needed to meet customer demand to integrate Linux and Windows. However, Novell has only invoiced $156 million of Microsoft’s original $240 million certificate purchase, leaving 35% of the fund still unused.  (Source: http://www.networkworld.com/news/2008/082008-ms-novel.html?hpg1=bn)

Hmmm. It does seem a bit strange now that you mention it.

Only time will tell, but my bet is on Anthony’s call. I wouldn’t be a bit surprised to see Microsoft buddying themselves up with Novell to enable them to compete with Cisco.

But there’s one problem with the Microsoft strategy. A rotten fish by any other name still smells like a rotten fish. And we’re sorry Microsoft, but we don’t care who you align yourself with; we’ll never trust you with our security. NEVER.

What’s that saying, “Fool me once, shame on you. Fool me twice, shame on me.” After the devastation and destruction Microsoft has caused me when I trusted them with my security? Well, enough said.

Hey Cisco! Watch your back in case we’re right!

How about that? I’m giving you a quickie this Friday!

A few things I wanted to let you know….

Just in from Google Hosted News: Obama to YouTube Weekly Address

US president-elect Barack Obama is to make the first YouTube address to the
nation on Saturday, recording a talk not just on radio but also on video, a
spokesman said Friday.

“President-elect Obama will record the Weekly Democratic Radio Address on
video and radio,” spokesman Nick Shapiro said.

There is more to the story but you can read it yourself here:

http://www.google.com/hostednews/afp/article/ALeqM5jBiuUwfVUn3jECNK5449eVRQR3fg

(Don’t want to be accused of stealing their content!)

Next item you need to know: Twitter apps: fun or dangerous?

This comes from one of my twitter friends and a LinkedIn connection/Group member. It seems that before the election, a website appeared out of thin air that was supposed to be a mock vote for the candidates. It required you to login to your twitter account from their website.

You know what’s coming, don’t you???

You got it!

As of this writing 24,372 people have given their Twitter IDs and passwords to this cool little application, which incidentally is owned by M, Krishnapriya  in Bangalore, India.   I am not even suggesting that Twitmarks is a malicious site. I am just showing how easily people give up their credentials. There are dozens of these sites.

My friend goes on to say much more in this blog post and another. So I’ll provide you the links here to visit and read for yourself. This blog is worth visiting! I am going to add his site to my favorites because I’m learning a lot from him too!

So here are the two important links you need to read further:

Twitter apps: fun or dangerous?

Twitter is Doomed

I do hope he’s wrong about Twitter being doomed! I like it! Probably too much!

The final thing you need to know: CISCO: Chance to win $10,000

This is not a hoax. Not a circulating spam mail. This is a legitimate contest sponsored by CISCO!

Time is wasting so you need to check out this YouTube video immediately!

That’s it for right now. But if I come up with some more quickies, I’ll let you know!

Have a great weekend!

Debbie

Just read an InformationWeek article by that name that is just too good not to share!

I’m becoming a social networking maniac and use twitter all the time! This article taught me a few things I didn’t know about twitter tools!

In case you don’t want to click off my wonderful blog and visit their page, here’s the low down.

The first tool they reference is TweetDeck, which I already told you about when I complained about their incompatibility with Shortkeys and WS_FTP software in a recent blog post.

TweetDeck allows you to post tweets and read all your tweets right from your desktop! It also allows you to look up a profile and follow, along with automatically updating your tweets on a regular basis so you get real time tweets.

The next tool they discuss is twhirl and it’s another software like TweetDeck.  Built also on Adobe Air platform, this one allows you to connect to multiple accounts including: twitter, friendfeed, Laconica, and seesmic.

The next two tools are related to Firefox and twittering (or is that tweeting?). Twitbin and TwitterFox. I personally had issues with Twitbin and never tried TwitterFox. But since I’m using TweetDeck, I really don’t see a purpose for using my Firefox with twitter any longer. But these may work for you!

The next tool they mention is Twitter for Facebook App. Now I jumped on that one! It’s just so hard to keep everything updated! This does make it so much easier.

Twittelator is a mobile type twitter application for ipod touch and iphone. There’s a regular version and pro version. The pro version is supposed to be available through the itunes store.

Now, as if all these are not enough, if you got a Blackberry, try to stay calm! Twitterberry lets you send and receive tweets off your Blackberry!

The next two tools allow you to automate twitter with twitterfeed and tweetlater. I use Tweetlater to automate my follows. When someone follows me, it sends them a private message inviting them to subscribe to our newsletters. (Good marketing, isn’t it?)  I’m not sure what twitterfeed does exactly, but you can rest assured I’m checking it out!

Friendfeed is further automation and allows you to connect multiple social networking feeds. I just set mine up but I’m still not comfortable with what it’s supposed to do. Anyone who uses it care to enlighten me?

Next up in their list is TwitPic. With TwitPic you can post images to twitter. (I definitely need a new cell phone!)

According to the InformationWeek article:

You can post from the TwitPic Web site, but most of the time you’ll use a Twitter client on a cameraphone, such as TweetDeck, Twhirl, Twittelator or TwitterBerry…

The last tool listed in the Information Week article is FriendorFollow. This allows you to find out who you’re following but they are not following you. Who’s following you that you’re not following, and people you’re following and are following you back.

The only time I usually get rid of a follow is if they are promoting so much that there’s no real conversation going on. Or of course, if someone offends me which only happened once. I don’t follow him any more.

Now, as if all this fun stuff isn’t enough, there’s a section in the article called, Twitter Tools to lower your self esteem. Qwitter and Twitterholic.  Qwitter, once set up, will send you an e-mail with the twitter post that caused the person to unfollow you. Too bad the guy that offended me didn’t have that!! Or did he?

I don’t understand why twitterholic was filed under “lowering your self esteem”. I would think it’s a good thing that I’m not in the top 100 twitterers? How does anyone get any work done?

So there you have those. I’ve got another post I’m reading now that has 27 cool tools and resources for twitter addicts! What? You want the link? Okay, from one addict to another, here it is: http://speckyboy.com/2008/11/12/27-cool-tools-and-resources-for-the-twitter-addict/

See you at the next 12-step meeting of Twitterholics Anonymous!

BTW*, to view the full InformationWorld article, click here!

*BTW=By the way for those who are newbie (new users) to this kind of talk! Just teaching folks! It’s what I do! Never assume that everyone knows what you’re talking about!  Oh crackers! I guess I need to explain twitter?  Next post! Sorry about that!

Friends and clients have often told me that I’m too humble and don’t give myself credit for how smart I am and what I do. Perhaps their right because I’m getting more and more frustrated when I find some big huge online magazine taking a concept I wrote about earlier and then getting all the traffic.  It really ticks me off.

Okay, so just what am I ranting about? On September 7, 2008 I wrote a blog post called: Death of Web 2.0 where I predicted the death of our high bandwidth consumption Internet. Videos, video blogs, online movies, songs, tweets, and all the lovely features of a multimedia web because Corporate America - specifically, ISPs decided it’s time to charge us for extra bandwidth and put caps on our usage. Do you remember that post? (If not, read it from the link!)

So now, what do I find in my InfoWorld newsletter on November 11? An article titled: Is our Internet future in danger? And what do you suppose they are discussing?  Yes, you got it! The impending doom due to bandwidth caps.  Their article, of course, spans 5 pages.  (Does anyone read that many pages?)

And their post comes over 2 months after my prophetic post!

Does anyone give me the traffic? No.

Does anyone give me credit for my post? No.

A trackback? No.

So, I’m blowing my own horn. Tooting my horn. Giving credit where credit is due. (And ths isn’t the first time I’ve been first either - one of many!)

There’s my rant. Will it get me any more traffic? Probably not.

Will it get me any more subscribers? Probably not.

Did it make me feel better? Absoultely!

Thanks for listening. I feel much better now!

Oh, and by the way! If you want a free subscription to Information Week, (not InfoWorld) go to: http://go2.iweek.com and follow the on-screen prompts. I got the free referral card in my latest edition! Just another added benefit of sticking with me! 

It’s official! Steve Ballmer has gone insane. I’m sure of it now. Beyond a doubt!

What planet or alternate reality is this guy living on? Is he on crack? Meth? What??? And I definitely don’t want what he’s smokin!

I’m reading an InfoWorld article in my Firefox browser decked out with all kinds of extensions that suit me just fine.  The article headline reads: Ballmer: Microsoft ‘interested’ in open source browser.

All well and good, and sound interesting.

Well, someone in the audience in Sydney where Ballmer spoke at a Power to Developers event, asks:

“Why is IE still relevant and why is it worth spending money on rendering engines when there are open source ones available that can respond to changes in Web standards faster?”

Great question!

But here’s what Ballmer says in response:

“Ballmer began his answer philosophically, saying Microsoft will need to look at what the browser is like in the future and, if there is no innovation around them, which he thinks is ‘likely,’ Microsoft may still need its own browser because of proprietary extensions that broaden its functionality.”

Does anyone else find something wrong with this statement?

No innovation around browsers likely? EXCUSE ME? Might I call to your lame a** attention to Firefox? Firefox extensions? Google Chrome? Apple Safari? No innovation?

If anyone lacks innovation Mr. Ballmer, it is Microsoft and you!

I cannot believe the crap that comes out of this mans mouth! It’s unbelievable to me.

Does Steve Ballmer live in a Microsoft reality and Microsoft bubble? Nothing in the freaking world exists outside of Microsoft?

What kind of innovation are you looking for Ballmer? Something centered around your “proprietary” Highness? Or is the term, “proprietary” Dictatorship?

The article goes on to quote Ballmer as saying,

“What gets Steve Ballmer excited when it comes to new products? Well, there’s Steve Ballmer, the user and Steve Ballmer, the developer evangelist.

“From a user perspective I’m excited by Windows Mobile 7 and the next release of Windows Live at end of the year,” he said.” (Page 2)

Obviously Mr. Ballmer isn’t a real user of his own products like I and most of the people I know, because nothing makes me cringe more than having to use a Windows POS software. (Piece of S*$#)

If I could afford a Mac, I’d be using one right now! (With security and AV of course!)

But since I can’t afford one, I’m getting my partition set up for Ubuntu. It’s the only way I can get out of this nightmare called Microsoft.

Maybe it’s just me, but every time Ballmer opens his mouth I want to slap him.

Is it just me, or do the rest of you think he’s somewhere off in outer space? Does this make sense to you? Am I the only person who feels this way??? Your comments are more than welcome!