There may be a new type of Trojan Horse attack to worry about

From Computer World

The U.S. Federal Bureau of Investigation is trying to figure out who sent five Hewlett-Packard laptop computers to West Virginia Governor Joe Mahchin a few weeks ago, with state officials worried that they may contain malicious software.

Sources familiar with the investigation say other states have been targeted too, with HP laptops mysteriously ordered for officials in 10 states. Four of the orders were delivered, while the remaining six were intercepted, according to a source who spoke on condition of anonymity because of the ongoing investigation.

This is a great way to penetrate a large organisation. Many people would just take the attitude that someone messed up and forgot to inform them. After all we all know how useless 'they' are, don't we?

With users now more reluctant to install suspicious software or open attachments on their networks, scammers appear to be looking for new ways to get inside the firewall. On Tuesday, the National Credit Union Administration warned that an unnamed credit union had received two fake CDs designed to look like training materials. Installing the CDs "could result in a possible security breach to your computer system," the administration warned.

Scammers have also tried to put malware on USB devices and then left them outside company offices, hoping someone will plug them into a computer and inadvertently install malicious software on the network. Many Windows systems are configured to automatically run software included on CDs and USB devices using a Windows feature called AutoRun.

As you can see, it does not have to be expensive laptops. A cheap memory stick will entice many people too. Do yourself a favour right now - turn off AutoRun on your removable media devices like USB and CD.

Windows 7 first look: More than just "Vista, fixed"

From ZDNet Blogs

Windows 7 won’t be officially available to the public until next week—Thursday, August 6, to be exact—when MSDN and Technet subscribers will finally get the chance to download the software legitimately and activate their copies with product keys. It’s the first step on a long rollout that will end October 22 when the software will be available for purchase in retail boxes and on new PCs.

I’ve been able to get a head start, using the official RTM build (7600.16385). For the past 10 days, I’ve been methodically installing and testing the final release of Windows 7 on a wide range of desktop and notebook configurations in my home and office. I’ve done upgrades and clean installs, with and without the Easy Transfer utility, using different editions in 32-bit and 64-bit flavors. I’ll have a through review of Windows 7 next week, including a deep dive into its most interesting new features. Today, I want to offer some first impressions and an image gallery based on my initial experience with these final bits.

Windows 7 isn’t perfect, but it is greatly improved over its predecessors in many ways. Calling it an “evolutionary” release in comparison to Windows Vista is probably a fair characterization. However, if you assume that Windows 7 is simply “Vista, fixed,” you’ll miss many small but meaningful changes and several large ones that give Windows 7 its own identity. In daily use, I continue to be impressed by the attention to detail that went into the Windows 7 iterations of features that are part of every Windows user’s daily routine. I’ve also found some hidden gems, which I’ll spotlight here and in next week’s full review.

Read the full article on ZDNet. I am looking forward to trying the release version of Windows 7. I have been happy with Vista for a while now, but am eager to give Windows 7 a try, especially on systems where I am still running XP.

Has Microsoft switched from defense back to offense?

From Tech Republic

It’s easy to forget that Microsoft started its life making programming languages. The world’s largest software company, which was founded in 1975, didn’t throw its first touchdown pass until it backed into the contract with IBM to supply the operating system for the first IBM PC in 1981.

During the 1980s and 1990s, Microsoft may not have built the best products or been the first mover in most of the markets where it built products, but it was the scrappiest and the most tenacious (and sometimes, the most ruthless) competitor in the computer market. And, that’s why it succeeded.

But, when Microsoft was hauled into court by the U.S. Department of Justice in 1998 and charged with monopolistic and anti-competitive practices, the company lost its edge. It became a much less aggressive company.

However, there is mounting evidence that Microsoft is casting itself as the underdog and going back on offense, as Larry Dignan pointed out last week. Here are the five plays that Microsoft has run recently that make me think the company doesn’t want to simply defend its turf any longer, but wants to move the ball down the field

I couldn't agree more. As I have watched Microsoft's moves against Apple and Google and the capabilities of Server 2008 and Windows 7 as well as their renewed push in the development tools arena, I have been struck by the impression of a slumbering beast awakening. It's not just that they are making moves, they are making the right moves.

The one essential truth of computer security

From InfoWorld

Who doesn't love that scene in "A Few Good Men" in which Jack Nicholson's character tells Tom Cruise's character, "You can't handle the truth. I have neither the time nor the inclination to explain myself to a man who rises and sleeps under the blanket of the very freedom I provide, and then questions the manner in which I provide it. I would rather you just said 'Thank you' and went on your way."

I often feel like I'm acting out that scenario when speaking to CIOs and senior security leaders. They want me to tell them how to stop hackers and malware from invading their environments. Usually I'm consulting on some multitiered firewall/proxy/security solution aimed at protecting back-end databases. We talk about packet-inspecting firewalls, intrusion detection, two-factor authentication, and all sorts of high-tech defensive solutions that add several layers to their defense-in-depth protection.

Then I say something like, "That's all great, but it won't work." I usually have their attention by then.

Next, I throw out the inconvenient truths:

• Most of today's security risk in the average computing environment comes from "drive-by downloads" -- that is, trusted insiders get infected by Trojan software that they were tricked into installing.
• If you allow your end-users to install any software they want, then your risk of security exploitation is high.
• Even if you are fully patched and the software you run contains zero bugs (this is never true), it barely decreases the risk from drive-by downloads.
• Most malware and malicious hackers are criminally motivated and seek monetary gain.
• End-user education is highly overrated and will fail.
• Your firewall, your anti-malware software, and your IDS will fail.

This is hard for many people to accept, but I think we need to start thinking in terms of a office computer being a business tool. It is NOT a general purpose computing device to be used for personal purposes by employees. Harsh? Of course it is, but not as harsh as a trojan deleting essential work information or company secrets sold to the competition.

Manchester City Council pays $2.4m in Conficker clean up costs

From ZDNet Blogs

How severe can the impact of the Conficker worm be on a single city council that has apparently not implemented basic security solutions in place?

Pretty severe according to a recently released a report entitled “Service interruption resulting from ICT disruption in February 2009” which details the financial costs of a Conficker incident affecting Manchester City Council’s network - 1.5 million pounds in clean up costs and lost revenue from the downtime.

This organisation did not have security in place that would have mitigated the attack. And cleaning up after an attack is always a lot more expensive that preventing the attack. The message is clear - being proactive is cheaper than being reactive.

Microsoft Bing: Much better than expected

From CNet

Microsoft on Thursday took the wraps off Bing, the rebranded and rebuilt search engine formerly code-named Kumo, designed to replace Live Search. It's a solid improvement over the previous search product, and it beats Google in important areas. It will help Microsoft gain share in the search business. It's surprisingly competitive with Google.

Bing isn't available to the public yet, but you won't have to wait long. Starting on June 1, some users will get Bing search results from Live Search. On June 3, we're told, Bing will be Microsoft's new default search. We got early access to the service. Here's how it looks.

I have been using Bing on my Windows machines. Obviously IE7 automatically started using Bing, and Firefox and Chrome were easy to change. Sadly Safari does not allow one to make changes to the default search engine without some additional software.

I have enjoyed using Bing and have even found it more useful than Google in some instances. That in itself was surprising, given Google's domination of Search and the dismal performance of Windows Live Search. I especially like the short preview of each site's contents and links on that site that are shown when one rolls the mouse over the right side of a link. I continue to use Bing as my default on my Windows machines and thus far have not missed Google.

AV-Test calls Microsoft Security Essentials "very good"

From ZDNet Blogs

I know that it’s hard for some people to accept it, but Microsoft is capable of getting things right. One such example of “getting it right” is Microsoft Security Essentials beta. While some security vendors have been quick to dismiss this new tool, the independent testing company AV-Test ranked the beta product as one of the best security products tested.

I like Microsoft Defender as an Anti-Spyware tool, and thus far Microsoft Security Essentials (Anti-Virus tool) is getting good reviews. Sadly AVG is succumbing to the Symantec throw-in-everything-and-the-kitchen-sink philosophy. I prefer a keep it simple solution that consumes minimal system resources and this looks to be it. I was too late to get a Beta, but I will be keeping an eye out for the release version.

Fibre backbone cables for Africa

From MyBroadband

Fibre backbone cables spreading across the continent should lead to cheaper traffic between countries

With the arrival of six international fibre cables over the next two years, the race is on to provide national fibre backbones and competitive connections between countries. There have been for announcements this week that show that the arrival of these international cables has sparked a wave of fibre build-outs. These new routes should lead to both cheaper national backhaul rates and the switching of inter-country traffic from international to regional routings.

The next few years will be exciting as South Africa gets more international bandwidth. I don't think prices will come down as fast as people hope because international bandwidth costs are only one part of what makes up an Internet access product, but it should drive competition and hence meaningful price improvements across the board.

Apple vs. Microsoft: Yet another upgrade pricing fiasco

From ZDNet Blogs

Once again, Apple shows Redmond how it should be done on pricing upgrades, especially ones with plenty of internal fixes. Will Windows users feel grateful when Mac users get their upgrades for half to a quarter of the price? Or is it another sucker moment?

At the Apple Worldwide Developers Conference in San Francisco on Monday, Phil Schiller, senior vice-president of worldwide product marketing, laid out the complex upgrade pricing for the next version of Mac OS X, called Snow Leopard: $29. And $49 for a 4-seat “family” license, which brings the cost per seat down to $12 and change.

Given that Snow Leopard is mainly a behind-the-scenes upgrade, although the fact that it frees up 3GB of disk space is not to be scoffed at, Apple have been smart to peg the upgrade at $29. I don't usually have a problem paying the $129 for an upgrade, especially as it's always the full system, but I must admit that it makes for a pleasant surprise, and a black eye for Microsoft given the Vista fiasco.

Google Apps is now an Exchange-replacement; Users can even keep Outlook

From Tech Republic

I’ve always thought of Google Apps as an product that’s trying to replace Microsoft Office with a simpler, cheaper, Web-based solution. However, on Tuesday Google unveiled Google Apps Sync for Microsoft Outlook, a new plug-in that allows Premier customers to access their Google Apps mail, calendar, and contacts using Microsoft Outlook, while also being able to have full Web access to all of our their data over the Web just like any other Google Apps customer.

This move changes the game. It pits Google Apps against Microsoft Exchange, the business world’s most popular email groupware platform. And, in many ways this makes a lot more sense for Google and allows the company to play to its strengths in building Internet-scale backend systems.

Exchange has been the one product the Open Source community have had problems replacing. Combine Google's Apps Sync and the trend towards cloud computing and this can result in a hit on Microsoft's Exchange revenues. Personally I think companies will continue to go for the locally hosted solution, especially in regions where bandwidth is expensive and/or unreliable.

Five keys to successful IT projects

From Tech Republic

One of the most important functions of an organization’s IT department is its ability to successfully implement projects: fixed duration activities with a specific result. Most IT leaders have realized that the commodity functions of IT, like keeping the network up and the servers humming are now a baseline expectation, and projects are increasingly becoming how they are judged on their success or failure.

IT projects can be a massive undertaking, with multimillion dollar budgets and an army of project staff and consultants that rivals a small company. With so much riding on the outcome of these projects, it’s imperative that you stack the decks in favor of success. To that effect I offer these five tips, garnered from my experiences working with companies around the world.

• IT projects don’t exist in a vacuum
• Implement processes, not software
• Decide already!
• Bring your ruler
• Partner wisely

Read about this points in more detail at Tech Republic.

These keys apply even for small IT projects. I see too many projects limping along because of a lack of will or direction, with companies wasting money in the hope that the project will magically fix itself. That is not going to happen, mainly because they are betting against the 2nd law of thermodynamics.

Spam Back to 94% of All E-Mail

From New York Times Blog

Spam, that annoying but ignorable scourge of the Web, has finally recovered from the jolt it received last November, when Internet backbone providers cut off McColo Corporation, a California Web-hosting service that spammers were using to coordinate e-mail attacks.

The average seven-day spam volume during the latter half of March is now at roughly the same levels as October of last year — around 94 percent of all e-mail — according to the antispam company Postini, a division of Google.

With the expectation that the Conficker botnet will be going live today I guess that this ratio is only going to get worse...

Safari successfully exploited in seconds in Pwn2Own contest

From Ars Technica

Putting his money where his mouth is, so to speak, security reseacher Charlie Miller exploited Safari in mere seconds to take control of a test MacBook in the Pwn2Own contest held during the CanSecWest security conference. In fact, he did so with a default configuration and all security updates applied. Microsoft's Internet Explorer 8 and Mozilla's Firefox 3 were also successfully exploited later in the afternoon.

What can one say? These were fully patched machines. Apple OS/X fell first then Microsoft Windows, and the researchers say it is much easier to exploit OS/X than Windows. This is yet another sign that Apple is lagging behind in the system quality stakes.

Windows 7 build 7048 vs. Windows 7 beta 1 vs. Vista vs. XP performance shootout - which is best?

From ZDNet Blogs

It’s clear that some of the results here are all over the place, and I’m putting this down this the fact that Windows 7 is still a work in progress (and realistically, probably will be for a good 9 - 12 months after launch) and drivers are still pretty new. However, four patterns do emerge:

• Windows 7 is, overall, better than both Vista and XP.


• As Windows 7 progresses, it’s getting better (or at least the 64-bit editions are).


• On a higher-spec system, 64-bit is best.


• On a lower-spec system, 32-bit is best.

Microsoft seem to have taken the lessons learnt during the Vista debacle to heart and that is good news for users of their products. Personally I have been happy using both Vista 64-bit and Leopard (OS/X 10.5.6). I am looking forward to both Windows 7 from Microsoft and Snow Leopard (OS/X 10.6) from Apple.

SA's tangled web

From My Broadband:-

According to a report released this week at the Internet Governance Forum, South Africa has fallen a long way in the African rankings since 2000, when it had 2.4 million subscribers representing 53 percent of internet users across the continent.

In 2009 South Africa represents only nine percent of Africa's total internet subscriber base, with 5.1 million users.

I think price is a major factor, but with Seacom scheduled to come online in the middle of this year, access prices are expected to drop substantially. Let's hold thumbs...