Friday, February 27, 2009

Cyberinsecurity

During my vacation I read a report by the Computer & Communications Industry Association, titled CyberInsecurity - The Cost of Monopoly: How the Dominance of Microsoft's Products Pose a Risk to Security. 
I don't recommend that everyone read this as it's rather dull reading. However, what is interesting I will outline below.

First, let me start by noting that this a report compiled from reports by "leading authorities in the field of cybersecurity." So, it's not just the ranting of some anti-Microsoft blogger.

The report is rather damning of Microsoft software. However! The overall problem is not so much that Microsoft's software is poorly designed, riddles with flaws, overly complex, etc., but that it is too ubiquitous. By making itself a monopoly, Microsoft has undermined itself. 

As the report concludes, "These comments are specific to Microsoft, but would apply to any entity with similar dominance under current circumstances. Indeed, similar moments of truth have occurred, though for different reasons, with IBM or AT&T. The focus on Microsoft is simply that the clear and present danger can be ignored no longer."

An interesting experiment would be a call for all Windows machines throughout the world to be shut down just for an hour (although a month would be great!) in order to see just how clean and open the World Wide Web (WWW) and Internet traffic would become. 

The report can be downloaded at:
http://www.ccianet.org/papers/cyberinsecurity.pdf.

PDF and Excel Vulnerabilities

Just a heads up for everyone.

Adobe Acrobat and Microsoft Excel have some vulnerabilities that can effect Windows as well Apple computers that are using these applications. 

Be sure that you trust the source from which you getting any *.pdf (Acrobat) or *.xls (Excel) files prior to opening them. Also be sure that your virus protection is up to date. 


Also, consider using alternative programs:
Acrobat alternative 
for Windows: Foxit Reader
for Mac: Preview (built-in)
 Excel alternative
for Windows: OpenOffice, ThinkFree Office, Google Office, Gnumeric
for Mac: OpenOffice, NeoOffice, Think Free Office, Google Office, iWorks



Information on vulnerabilities with respect to various programs can be found at Secunia's website. In fact! Secunia has a tool that can scan Windows computers and provide you with information as to updates for pretty much all the programs you have. However, I've noticed that whereas most people have Java and Flash installed on their computers, Secunia detects all versions of these programs on your computer and therefore ends up telling you that you need updates for them. Java and Flash, however, are two programs that always tell the user that there are updates available. So, you might want to disregard any warnings Secunia gives you with respect to these applications.
Secunia's scanning utility is located at:
http://secunia.com/vulnerability_scanning/

Friday, February 13, 2009

AntiVirus Protection - A Continuation

In my last newsletter I addressed issues relating to the nature of malware (viruses and spyware) and how they can infect your systems despite having antivirus and antispyware programs (hereinafter, AV Programs).

The recent issue of Redmond Magazine has a rather good article about the same issue. A link to the article may be found at the end of this post.
In short, however, here is the advice they give (and remember this is a pro-Microsoft publication!). 

1. If you get a pop-up asking you to install some AV Program, or telling you that your computer is infected, in most cases you'll probably want to click on the X in upper-right corner of the window. Don't click OK or anything else.
As the article points out many computers get infected by installing a virus by responding to just such warnings.
Be sure you know the warning that your AV Program will give you and avoid any other messages.

2. In order to avoid the aforemetioned possibility, don't use Internet Explorer.

3. Don't run your computer as an administrator. You should not have administrative rights, particularly when browsing the Internet.

4. Get this: they say consider using Vista (?!) or Linux or a Mac!

The article also has a list of some of the more common names for faux AV Programs that may try to install themselves on your computer. 

http://redmondmag.com/features/print.asp?editorialsid=2617

Tuesday, February 10, 2009

Anti-Virus Programs

Since I get a lot of questions about anti-virus programs, I thought I would try to give a very brief and basic overview of how anti-virus and other anti-malware programs work.
I would particularly like to concentrate on the free programs since a lot of people are using them. The main free anti-virus programs that I am aware of are AVG, AVIRA, and Avast. 

As we all understand viruses, spyware - that is malware is constantly flooding through the Internet, searching like a parasite for a host to live in (i.e., your computer). One of the means for protecting your computer from malware is to have various anti-malware programs constantly on the lookout. I'll just refer to all anti-malware programs as AV Programs for short.
All AV Programs must update themselves. All free AV Programs automatically update only once a day. Let's say you're using a free AV Program. It updates at 00:00 Monday just after midnight. It's next update will occur 24 hours later. Between these updates, new malware is being created and released. Most are just versions of known malware and will probably be detected. But some will be unknown to your AV Program. Maybe the AV Program will nonetheless find the malware suspicious and block or quarantine it. But there is the possibility that the malware will get through and infect your computer.
Now most AV Programs that you purchase update every hour, half hour, etc. You can even set them to probably update every 5 minutes. The window of opportunity for a new malware is thereby narrowed. 

Another consideration is the fact that once a new malware is discovered, there is still a period between the moment of its discovery and the moment, when the companies that develop AV Program release an update for that particular malware. So, again the malware has the advantage.

A final consideration is how good your AV Program is.  Provided below are the results of about 5 years of testing done by Virus Bulletin on some of the more well-known AV Programs. I have listed them in hierarchy of number of "successes". In other words the AV Program based Virus Bulletin's test. One should note, however, that many AV Programs were not tested (No Entry). As I recall I believe it is up to the company producing the AV Program to submit their program to Virus Bulletin for testing. Also the failures are over a five-year period, so the failure may have occurred just last month or 3 years ago. One other note is that the products may not have been tested just against Windows, but against other operating systems (e.g., Mac, Linux, Unix), but also different versions of an operating system (Windows 2000, Windows XP, Windows Vista). So, say for example should Sophos submit their product for evaluation in January 2009 for testing on Ubuntu Linux and it passes, they don't get a No Entry score, although maybe they didn't submit Sophos for testing against Vista. Finally, I should note that a failure does not necessarily mean that the AV Product let malware through. Looking through the failures I see that a lot of them are because the AV Product falsely identified a legitimate program as a virus (a false positive). So, the scoring below is not completely fair to the products. 

As for my opinion of these products. Although Symantec has a good rating, I find Norton very intrusive and pain to deal with at times. That doesn't mean it's not a great AV Program, just that I don't care for it a lot. 
Sophos is my personal favorite, but it is marketed more for corporations, than for personal use. They seem to be changing this policy.
It is my understanding that Kaspersky is also supposed to be a great AV Program. Whereas I have never used it, I cannot provide any personal assessment.
McAfee. I haven't used McAfee is ages. I have seen it installed on computers and it seems less intrusive as Symantec. 

As for the Free AV Programs, for years I have been recommending AVG. In my experience it has done quite well. Many people out there are saying Avira is much better than AVG. I have been using Avira on one computer to try it out. The one thing I don't like about Avira is that every time it updates it brings up a screen asking you if you would like to upgrade to the paid version. Kind of annoying, but worth it if it provides better protection. I have included also Avast, since it is free. However, I cannot advise using Avast on a Windows computer.


Symantec (Norton)
48 Success / 6 Failure / 8 No Entry

Sophos
45 Success / 15 Failure / 2 No Entry

Kaspersky
45 Success / 17 Failure / 0 No Entry

McAfee
38 Success / 21 Failure / 3 No Entry


The following are Free AV Programs

AVG (Grisoft)
25 Success / 22 Failure / 15 No Entry

Avast
28 Success / 23 Failure / 11 No Entry

Avira
16 Success / 3 Failure / 43 No Entry

Monday, February 9, 2009

Movie Review: Angels in America, Stop Loss, & God on Trial

Three movie reviews

1. Angels in America

Angels in America is an HBO series that deserves to be watched. I found the series to be rather long - sort of like Tolstoy. I guess I'm more a fan of conciseness, like Chekhov! Oh, well, there I go somehow bringing Russia into it.... Angels in America intertwines the stories of four gay men, their lives and their struggles with AIDS. Al Pacino plays an arch-conservative lawyer and closet homosexual - an oxymoron to the extreme, who is dying of AIDS. I have to say that I think this was perhaps Pacino's best performance ever! Another oxymoronic character is a gay Mormon! Whereas Pacino knows he's gay, this Mormon is coming to terms with the fact that he is gay. One other character has more the role of being the glue that brings all the characters together - although it is a fate and not of his own volition. However, it is this character who comes to understand the true meaning of love, and in this respect, he could be characterized as the main character. But the true primary character is a man struck with AIDS and having to deal with the issue of his own mortality, loneliness, love. 

Although this may not seem relevant to the movie, nonetheless I must quote one line from the movie that I loved:
"The white cracker who wrote the national anthem knew what he was doing. He set the word 'free' to a note so high nobody can reach it."

2. Stop Loss
Another Progie award nominee.

As the name implies this movie is about the forced reenlistment (stop loss) of Iraqi veterans. Stop Loss could be referred to as a modern-day Deerhunter, as most of the movie is about the lives of soldiers who have returned home after several tours only to discover they must return again. This effects not only the soldiers themselves, but their families and friends. The hero of the movie seeks to fight his return, which entails going AWOL. His comrades, family and friends are sucked into the whirlwind he has created and thus he must face not only the challenge of fighting for his own rights, but must take into consideration how his decision will effect the lives of those he holds closest. 

3. God on Trial

About a month ago I sent out an email encouraging people to watch this movie. Now I've finally watched it and can only recommend it even more! Since this was a PBS movie, however, I don't know if it will be available at a store or the library. But if you can find it, watch it! In fact, this is probably a play, so you might be able to find the actual play at the library.
Now, when I say this is another holocaust movie, this is not your typical one - at least, not as far as I know. The scene is an Auschwitz concentration camp. The Jewish inmates decide to put God on trial for breaking the covenant with the Jews. The ensuing trial (with God in absentia) is a excellent polemic for and against God. The arguments made with respect to free will were particularly interesting. 
Well, I won't give away the final verdict!

Netbook for only $99?

Many of you might be worried that I'm now sending out ads, or that I've sold my mailing list! But not to worry. Google has probably already sold it!
[that was a joke! --- maybe]

Anyhow, but for those of you interested in the title of this newsletter, here's the deal. I was walking by RadioShack this weekend and noticed in their window an add to get an Acer Netbook for $99.99.

Unbelievable?! Well, yes it is. There is a catch. 
Turns out it has a built-in AT&T data card. So, in order to purchase the machine for $99.99, you have to sign a 2-year agreement with AT&T. But there may be some of you out there on my list who are interested in such a computer. Alas, it does come with Windows XP installed.....

I recently tried out an AcerOne and was quite impressed. Of course, I removed Windows and installed Linux Ubuntu on it. I loved the super portability of the computer, but I found that I really needed a bigger screen and keyboard for my general usage. 

Thursday, February 5, 2009

Windows Users and Administrative Privileges

As I have been warning Windows users over the years, a recent report by BTC (see citation below) shows that Windows computers are far more open to vulnerabilities (attacks, infections) when the user has administrative rights. I have quoted the most important part of the article below and provided a link to the article. 


BeyondTrust Corp. (BTC), a software development company specializing in enterprise rights management, has indicated that the act of giving users administrative rights may leave systems more open to risk.

The report issued by BTC was prepared by assessing security vulnerability bulletins released by Microsoft in 2008, and identifying specific "mitigating factors" (those that could reduce or negate the risk of an attack) within the bulletin. If Microsoft reported that having fewer security privileges would negate or eliminate risk, BTC concluded that the vulnerability was admin-privilege related.

The result of the analysis of the 154 critical Microsoft vulnerabilities indicated that a full 92% could have been prevented if users were not logged into their systems with administrator status. BTC believes that restricting the number of users who can log in with these privileges will "close the window of opportunity" for attackers. This is particularly true for users of Internet Explorer and Microsoft Office.

http://www.infopackets.com/news/business/microsoft/2009/20090204_uac_vulnerability_found_in_windows_vista.htm

Wednesday, February 4, 2009

Movie Reviews: Wendy and Lucy, War, Inc.

Recently, on Thom Hartmann's radio program I heard about the 2009 Progie Awards. 
The Progies recognize features, documentaries and filmmakers for their outstanding achievement in promoting human rights and providing a voice for people of color, women, the working class, immigrants, gays, the environment and against war, censorship and political repression.
In other words, these are the most progressive movies of 2008. So, in the months to come I will be providing reviews of some of these movies. 

Wendy and Lucy
The first movie I watched was Wendy and Lucy - a story about a homeless woman, Wendy, and her dog, Lucy. This wasn't a great movie, but not bad. It's really about a few days in the life of a homeless person, who is trying to move on with her life. But one minor misdeed leads to a major setback in all her plans. If anything this movie deserves to be watched over all the escapist "blockbusters" that come out of Hollywood.

War, Inc.
Image a world where corporations superseded nations. Where all political and economic decisions are resolved through the envoys and armies owned by corporations. No, this is not about Halliburton or Bush & Co. - at least not directly. But it is vision of a possible future. War, Inc. is much in the vein of such movies as Catch 22, Brazil and 1984, all of which deserve more attention and viewership than they receive. I have to also add that I was happy to see John Cusack as a hit man - his erstwhile 'attractive' dark side is finally permitted to find true expression. 



For your information here is a list of the nominees for the Progie:

The nominees for THE TRUMBO, The Progie Award for BEST PROGRESSIVE PICTURE, are: MILK; CHE; BATTLE IN SEATTLE; THE VISITOR; WALTZ WITH BASHIR; WENDY AND LUCY.

The nominees for THE GARFIELD, The Progie Award for BEST ACTOR, are: SEAN PENN (MILK); FRANK LANGELLA (FROST/NIXON); BENICIO DEL TORO (CHE); JOSH BROLIN (W.); RICHARD JENKINS (THE VISITOR).

The nominees for THE KAREN MORLEY, The Progie Award for BEST ACTRESS, are: ANGELINA JOLIE (CHANGELING); MICHELLE WILLIAMS (WENDY AND LUCY); SALLY HAWKINS (HAPPY-GO-LUCKY); KATE WINSLET (REVOLUTIONARY ROAD, THE READER); MELISSA LEO (FROZEN RIVER).

The nominees for THE RENOIR, The Progie Award for BEST ANTI-WAR FILM, are: STOP-LOSS; WALTZ WITH BASHIR; WAR, INC.; BODY OF WAR; THE LUCKY ONES.

The nominees for THE GILLO, The Progie Award for BEST PROGRESSIVE FOREIGN FILM, are: WALTZ WITH BASHIR; CHE; THE EDGE OF HEAVEN.

The nominees for THE DZIGA, The Progie Award for BEST PROGRESSIVE DOCUMENTARY, are: BODY OF WAR; TROUBLE THE WATER; TRUMBO; STANDARD OPERATING PROCEDURE; RELIGULOUS.

The nominees for THE BRANDO, The Progie Award for BEST PROGRESSIVE FILM ACTIVIST, are: SEAN PENN; DANNY GLOVER; JOHN CUSACK; SPIKE LEE; ROBERT GREENWALD.

The nominees for THE SERGEI, The Progie Award for Best Progressive LIFETIME ACHIEVEMENT, are: PAUL NEWMAN; JEAN-LUC GODARD; KEN LOACH; HARRY BELAFONTE; DANNY GLOVER.

Hacking Into the Past

In my youth, I would take apart various electronic games, un-soldering and re-soldering them, and taking pride in the fact that that the suc...