Cloning a Windows 11 system

My wife's Windows 11 computer needed a new SSD. Here's a summary of what I did, the problems I encountered, and how I solved them.

Naked Security: How a gaming mouse can get you Windows superpowers!

How a gaming mouse can get you Windows superpowers!
By Paul Ducklin, 24 Aug 2021

What if you’re a gamer who wants to be a sysadmin? On someone else’s computer?

Well, apparently, until last week at least, gamer-centric mice and keyboards from popular vendor Razer could help you to do just that.
...

• You plug in a Razer gaming mouse for the first time.
• Windows detects that this device type has special software and drivers that will make it work Even Better than a regular mouse.
• Windows finds Razer’s official addons in the Windows Update cloud.
• Windows downloads and launches the offical addons so you don’t have to.
• The Razer app helpfully ends with a clickable directory name, showing you what ended up where in the installation process.

...
The problem in this case is the point at which Razer’s app helpfully displays the name of the software installation directory at the end, even though it doesn’t need to.

That’s an active link in Razer’s app, so you can right-click on it and view the directory in File Explorer.

Then, once you’re in Explorer, you can do a Shift-and-right-click and use the handy option Open PowerShell window here, giving you a command-line alternative to the existing Explorer window.

But that PowerShell prompt was spawned from the Explorer process, which was spawned from Razer’s installer, which was spawned by the automatic device installer process in Windows itself…

..which was running under the all-powerful NT AUTHORITY\SYSTEM account, usually referred to as NTSYSTEM or just System for short.

So the PowerShell window is now running as System too, which means you have almost complete control over the files, memory, processes, devices, services, kernel drivers and configuration of the computer.

Wow. A chain of good intentions all leading to an exploitable system vulnerability. I realize that Razer has (or will soon) fix this bug in their driver installation tool, but it seems to me that Microsoft should do something to prevent this from being possible in the future. Maybe do something so an installer trying to open a URL (or an Explorer process) does so at the user's normal privilege level instead of at the driver installer's level (which, of course, needs to be at a higher level in order to perform the installation).

HubPages: 86 Mac Plus Vs. 07 AMD DualCore. You Won't Believe Who Wins

86 Mac Plus Vs. 07 AMD DualCore. You Won't Believe Who Wins
Hal Licino, last updated on March 20, 2011

The Most Outlandish Computer Comparison Ever!

Bloat. If you think that Americans are getting fatter, take one good look at the operating system (OS) your computer is running right now. It gets larger and more weighed down with every update. We are in the third decade of global personal computing, and have we really progressed that far?
...
For the functions that people use most often, the 1986 vintage Mac Plus beats the 2007 AMD Athlon 64 X2 4800+: 9 tests to 8! Out of the 17 tests, the antique Mac won 53% of the time! Including a jaw-dropping 52 second whipping of the AMD from the time the Power button is pushed to the time the Desktop is up and useable.
...
Is this to say that the Mac Plus is a better computer than the AMD? Of course not. The technological advancements of 21 years have placed modern PCs in a completely different league of varied capacities. But the "User Experience" has not changed much in two decades. Due to bloated code that has to incorporate hundreds of functions that average users don't even know exist, let alone ever utilize, the software companies have weighed down our PCs to effectively neutralize their vast speed advantages. When we compare strictly common, everyday, basic user tasks between the Mac Plus and the AMD we find remarkable similarities in overall speed, thus it can be stated that for the majority of simple office uses, the massive advances in technology in the past two decades have brought zero advance in productivity.

h/t What The Daily WTF?

I have no problem believing these results either. Not counting the need for modern HTML rendering and web security standards, there is really nothing I do with computers today that I couldn't do with the hardware and software I was using back in the mid-90's. I would be a bit cramped with a Mac Plus, but I would have no problem with a Mac Quadra 840AV, which I used for a long time until one day the hardware simply refused to power-on anymore.

South Koreans required by law to use Internet Explorer.

The Washington Post writes about how a 14-year-old law, intended to make internet commerce more secure has produced some really annoying unintended consequences.

The true cost of content "protection"

Peter Gutmann, in the above-linked article, describes many of the insane requirements that Microsoft and movie studios are making in order to try and prevent piracy of HD content. He points out that the requirements are draconian, vague, physically impossible, extremely expensive, and will make you want to throw out your computer and go back to using clay tablets.

But if you want to play any "Premium Content" (DVDs, HD movies, SACD audio discs, etc.) on Windows Vista, you will be forced to go through all this BS. This means buying new, very expensive hardware, running software that no currently-shipping processor can run at full speed, and watching/listening to it only in a highly-degraded form. And if any software on your computer tries to bypass this, Microsoft can disable all of it without notice, leaving you with a box that may not even be able to boot again.

Sounds too stupid to be true? It does to me, but Mr. Gutmann backs up all his claims with primary source documents straight from Microsoft. This is real. And your only way of saying no is to refuse to play any HD content on your PC (refusing to upgrade to Vista would also be a good idea.)

Alkyproject.com - bringing Microsoft Windows programs to Linux and Mac!

And here's yet another approach to getting Windows apps to run on other platforms.

First there was emulation. You create a virtual PC, boot Windows into it, and run your program there. It works, but it's slow. You're emulating an entire processor, which is never fast. And you need to buy a Windows license (if you want to be legal.)

Then there were cross-compilation libraries. You take your Windows sources and compile them against the library to get an app for another platform. These work well, but they're only useful to someone with access to the source code (like the original developer.)

Then there were library-server systems, like WINE. No processor emulation (so you need an Intel-based computer), just OS emulation. You run a server that loads the app, links it up against appropriate libraries, and then runs it. This works, but you need that server, and all the associated libraries, in order to run your application.

And now there's Alky. If I understand their web site correctly, Alky reads your Windows app and generates a native app from it. In other words, it treats a Windows app as source code, which it proceeds to recompile into whatever your own operating system requires. When it's done, you have a native app, and can throw away the original.

This isn't the first time this has been done. Java systems do this in order to get good performance (since interpreting bytecode is slow.) The difference is that Java systems use a just-in-time compiler. They compile the app into native code on an as-needed basis, but they don't keep the results of the compilation. If you quit and re-load the application, it has to re-compile the app.

I have yet to try out Alky, but if it works as promised, this could be a really big thing. Of course, many of us said that about emulators (like Wabi) and WINE, so I could be wrong.

Windows Vista - train wreck on ice

A disgruntled Microsoft employee calls for the termination of Microsoft's top brass, due to Vista's repeated schedule slippage.

More interesting are the numerous comments (hundreds) that follow. Many of them are from Microsoft engineers complaining about all kinds of horrible things. Microsoft is clearly a Dilbert company. And I now feel a lot better about my company (which isn't even close to this disaster.)

And I'm very happy I didn't accept Microsoft's job offer back in 1998!

How to set up a new broadband connection

Moving from dial-up to broadband is a great thing. You can do things that would be impossible on dial-up connections, like video conferencing, movie downloading, and a great many other things. But if you're not careful, it can also be a nightmare. Being connected to the internet at high speed 24 hours a day makes it an attractive target for hackers and the malware they use.

But with a little bit of precaution, these problems don't have to happen. Here are a few tips for making the transition to broadband quick and painless.

1. Get a router. A consumer-grade gateway router doesn't cost much (often under $100). A router provides several features that help enormously.
   • NAT. Short for Network Address Translation. A broadband service provider typically provides only one IP address, which will only allow one computer to connect to the internet. NAT is a facility that allows multiple computers to share that one address. You can have an entire network of PCs all connected to the router (either directly or with a hub). The router will assign a private IP address to each computer and will translate all their addresses to the one address assigned by your ISP. It also tracks connections and remembers which computer created each one, allowing them all to access the internet at the same time. If you have more than one computer, this feature is an absolute necessity.
   • Firewall. When NAT is being used, a packet coming in from the internet could be sent to any one of your computers. If the packet is part of a connection that one of your computers initiated, the router will know which one to send it to. If the packet is not part of an established connection, however, it won't know where to send it, and the packet will be dropped. In other words, computers on the internet can not create connections to your computers. Although this can not prevent all hacking attempts, it will block a very large percentage of them.

     Because of the firewall benefits, I recommend that you NEVER attempt to connect to the internet without a router. Without a firewall (hardware or software-based), a Windows PC can be hacked in as little as four minutes.

2. Make sure your operating system software is up to date. On Windows XP, this means you must install Service Pack 2, and apply any high-priority updates that have come out since. (And there are a lot.) You should apply these as soon as possible, if they're not already installed. If you can't take the time to download Service Pack 2 (it is a very large download), you can order it on a CD for free. For the rest, you can visit http://windowsupdate.microsoft.com/ with Internet Explorer to install the updates.
3. Make sure you have an anti-virus package installed and kept up to date.
4. A software-based firewall, like the one that comes built-in to Windows XP Service Pack 2, is a good idea in addition to the firewall features you get from a router.
5. If you plan on setting up a wireless network, make sure your hardware (router and interface cards) support WPA2 encryption. Older encryption standards (like WEP and the original WPA) are much less secure. As a matter of fact, WEP security is so insecure that a hacker can crack it in only an hour or two.

Adobe is a gang of idiots

I launched the Adobe Reader to read a PDF file at work. It popped up a window requesting me to download and install an update. That's fine - updates happen. So I click the link, the update downloads and installs, and it asks me to reboot Windows. OK. lots of programs require rebooting Windows for no good reason. So I reboot and what happens? The stupid installer asks me to reboot AGAIN!

What kind of brain-dead installer requires not one but TWO reboots? Not even Microsoft's Windows system updates require this! Unless the Adobe Reader is more complicated than Windows itself, there is no justification for this behavior.

I don't know what's worse. That their programmers are unwilling/unable to write a proper installer or that Adobe's management considers this behavior acceptable for a product.

As far as I'm concerned no application should ever require a reboot of any kind. I never have to reboot when installing/updating my Linux boxes (aside from kernel updates.) I almost never have to reboot when installing/updating Mac stuff. But on Windows, every program wants to reboot after an installation. And Adobe wants you to do it twice.

WARNING! Your mouse has moved. Please restart the computer for the changes to take effect.

Encryption and security: an overview

This is an article I wrote a while ago for my SlashDot journal. Cross-posted here and updated for your perusal.

Q:

I would really have loved a debate / educational description from the guru's / opportunity to learn something myself about silc over ssh vs. the "secure " setting in yahoo vs. outlook vs. pine security maybe some opinions about the "I don't get viruses because I'm opensource" vs. uSoft vs. apple, etc.

A:

OK. Here goes. You asked for it.

I'm unfamiliar with "silc", so I won't talk about it. (Gee, that was fast.)

Encryption

Encryption comes in two forms: symmetric and asymmetric.

Symmetric encryption is anything where the same key is used to encrypt and to decrypt. As a really trivial example, an encryption scheme where you add one to every byte in the file. In this "add" algorithm, 1 is the key. It is symmetric, because you can subtract that same key from an encrypted message to get the original back.

Of course, a simple "add" encryption scheme is pretty useless and is easily broken. But many more complicated schemes (like DES and AES) are also symmetric. Although the decryption algorithm may be different, the decryption key will still be symmetric.

Symmetric encryption can be very secure, but it has one big loophole. Both the sender and the receiver need to have the same key. Which means they have to trust each other. If you send me a file encrypted with a symmetric algorithm, you have to give me your key as well. If a third-party gets your key, he can intercept your document in transit, decrypt it, modify it, re-encrypt it, and send on the result. I have no way of knowing that the file was tampered with.

Asymmetric encryption solves this problem. With asymmetric encryption, the key you need to decrypt a message is different from the one you used to encrypt it. To be properly secure, it should not be possible to derive one key from the other (or at least not without a LOT of work.)

Most modern encryption systems use (at least partly) a thing called public key encryption. This is a variation on asymmetric where the key pairs are interchangeable. That is, if I have a pair of keys (A and B), I can encrypt with either one, and the result can be decrypted by the other. When you generate a pair of keys, you arbitrarily declare one to be your public key and the other to be your private key. You keep the private key to yourself and never give it out to anybody. You give the public key to anybody who wants it (posting on web pages is not unusual.)

Now, suppose you send out a document encrypted with your private key. Anybody in the world can read it (because you've made your public key available for the taking), but because they have to use your public key to decrypt it, they know that you were the originator of the message. If someone else tried to forge the message in your name, your public key wouldn't work on it. If a third party decrypts your document and alters it, he can't re-encrypt it, because he doesn't have your private key.

Similarly, suppose I send out a document and I encrypt it with your public key. Only your private key will be able to decrypt it. So I know that only you can read the message. But anybody could have sent it to you (since everybody can get your public key.)

Either of these scenarios is useful. But ideally, you want the advantages of both. You want to make sure that only I can read your message, and you want it to be impossible for anyone to forge your identity. The solution is simple. You encrypt the message twice. Once with your private key, and again with my public key. In order to read the message, I need to decrypt it twice - once with my private key and then again with your public key. I know the message came from you (because your public key worked) and you know nobody else read it (because my private key is needed to decrypt the message.)

Public key encryption is computationally expensive, so it generally isn't used for encrypting actual documents. Instead, it will be used as a part of a key-exchange algorithm. A symmetric key will be randomly generated, used for one session only, and will then be discarded. Public key encryption is used for one side of the connection to give the key to the other side, so that third parties can't intercept it.

SSH

SSH is primarily meant to be used as a replacement for telnet (and related utilities like rlogin, rsh and rexec). The reason for this is that the telnet protocol (and rlogin/rsh/rexec) have minimal security. They do not encrypt their connection in any way.

This means that anybody sharing a network with you, the remote host, or any network in between, can see everything you're doing. It's trivially easy to get a PC to intercept all the packets that flow through an Ethernet network, and it's often not too difficult for an administrator to do this on other kinds of networks.

Someone snooping on a telnet/rlogin/rsh/rexec session can easily mirror your session. He can see everything you type (including passwords) and everything you see/download.

This doesn't often happen, because most internet service providers are trustworthy. But there are still cases where people on corporate and campus LANs have stolen sensitive data this way.

This also happens over wireless networks, like those found at trade shows and internet cafe's. WEP (Wired Equivalency Privacy) provides some degree of security, but WEP can be cracked fairly easily these days, and it won't stop someone who knows the encryption key (like anyone that has paid for time on the wireless LAN.) Wireless Protected Access (WPA) is more secure, but if history is any guide, it will eventually be cracked (and replaced with something even more secure.)

ssh solves this problem by encrypting everything. It also provides some optional features that will only allow people with pre-assigned security credentials access. So someone snooping your packets will be unable to view the content. (More accurately, the amount of computer power needed to break the encryption will be greater than what most people will be willing to expend.)

Although I regularly use telnet/rlogin/rsh/rexec for local traffic (between two computers at home or two computers at work) I try to avoid using it over the internet.

Also as a part of the ssh distribution is "sftp" which is an encrypted version of the FTP protocol. FTP suffers from the same problem as telnet - passwords are sent without encryption, so a third party could intercept them.

Secure web pages

You can encrypt web connections, as long as the server supports it. Encrypted URLs usually begin with "https:". (The "s" stands for "secure".) The HTTPS protocol can use a wide variety of different encryption standards, some more secure than others.

Most web browsers will let you know when the page is secured. Typically with a padlock icon or other appropriate icon in some corner of the browser window. You can usually click on this to view the page's security information (including the kind of encryption, the certificate providing the encryption keys, and the identity of the authority that generated the certificate.)

Any kind of encryption will keep third parties from snooping your packets. Encryption protocols with more bits in the key will be harder for third parties to crack, although anything can be cracked by someone determined enough.

You still have to decide whether the server on the other end can be trusted, of course. This is where the certificate and certificate authority comes in. A site's certificate identifies the owner of the site (usually including name and address contact information.) The certificate's data includes some encryption/authentication data to keep a third party from tampering with it. Part of that information involves a certificate from a certificate-agency. This means that that agency is vouching for the content of the certificate.

The idea here is that a rogue web site may try to impersonate a real one. For instance, an identity theft ring may create a server that looks like Citibank's server. Citibank will, of course, have a certificate that identifies them, but the rogue site will probably also have a certificate. So that alone isn't enough to make things secure.

The certificate authority takes care of that. Citibank's real certificate will be signed by an authority (Citibank uses VeriSign, if you're curious). When you choose to view the certificate, you will see that it is signed by VeriSign. Your web browser can use VeriSign's well-known public-key (built-in to most browsers, and available for download from others) to validate that the certificate is, in fact, genuine.

If the rogue site tries to use the same certificate, it won't match the server and your web browser should alert you. If they try to alter the certificate, it will no longer validate against VeriSign's public key - only VeriSign can issue certificates that their public key can decode.

Of course, you still have to decide whether to trust the remote server or not. No protocol will help you here. But HTTPS will let you be certain that the remote server really is who you think it is, and that no third party will intercept your session.

Microsoft Outlook

When people talk about Outlook's security, they are usually talking about something else. The problem there is how Outlook handles attachments.

People attach all kinds of files to all kinds of mail messages all the time. If I e-mail you a picture of somebody, it gets sent as an attachment. If I e-mail you a Word file I want you to read, it gets sent as an attachment. And if I e-mail you a program, it gets sent as an attachment. If I send you an HTML-formatted mail message with an image or background music or something, attachments will be used there as well.

All mail programs (well, all except the oldest and simplest ones) can deal with attachments. Either they make you save the attachment, or they may launch an external program for viewing it, or they may launch a plugin to view it, or they may be able to view it directly.

Outlook's problem comes from the way it launches attachments. There have been many bugs (most have been fixed by now, I believe) that will cause Outlook to automatically execute a program or a script that is sent in an e-mail attachment (usually with the message malformed in such a way as to trigger the bug.)

Once this happens, the program is running on your computer like any other program. As such, it can do anything. Worms (which are effectively viruses that spread to other computers on their own) often exploit this. They will e-mail themselves to others in a way that takes advantage of these kinds of bugs, so that the receiver will end up auto-launching the program, causing the worm to spread further.

The reason so many people hate Outlook is that these kinds of auto-launch bugs are extremely rare (and sometimes unheard of) in other mail programs, but Outlook has had tons of them over the years.

But the worms have been getting trickier. As Microsoft has fixed the various bugs that can cause executable attachments to auto-launch, the people developing the worms have gotten sneakier. Usually, they take advantage of human gullibility.

For instance, the worm may include (in the mail message's text) a message telling you that the attachment is a critical system patch from Microsoft, or an updater to some popular program, or a program needed to prevent your bank account from closing, or other similar gimmick. The user who trusts this message and runs the program gets infected with the virus/worm, and it spreads further on.

Antivirus programs routinely check e-mail for viruses and worms these days, so this works less often than it used to. So the viruses now often pack themselves into zip files for e-mailing. The idea is that virus scanners may avoid scanning a zip file. The message will direct the user to unpack the zip and run the contents - at which point the virus gets launched.

But virus scanners now scan the contents of zip files.

Which is where virusses like "Beagle/Bagle" come in. Zip files support built-in encryption. This way, only an authorized user can see the contents of the file. Obviously, if the zip file can't be opened, then a virus scanner can't scan the contents.

So the Beagle/Bagle virus sticks itself into an encrypted zip file. In the e-mail it sends itself through, it tells the recipient what the decryption key is. If someone is gullible enough to expand the zip, enter the decryption key, and run the contents, the virus will run.

The scary thing is that these viruses do spread. There are thousands of people who have been tricked into decrypting and executing the virus.

Macro viruses

In addition to these kinds of viruses, some popular tools that have macro languages (like the parts of Microsoft Office) can also be vectors for spreading viruses. A macro in a Word/Excel/PowerPoint document can spread to other documents and can even e-mail itself elsewhere.

Fortunately, today's virus scanners are smart enough to scan the contents of office documents. It's also easy to disable all macro capability in MS Office, which is usually a good idea, since very few people actually use them.

E-mail security

To be on the safe side, many people simply refuse to look at any attachments whatsoever. And with web-mail services and AOL (and possibly a few others) this is easy - you don't even have to download the attachment from your server if you want to delete it without opening it.

But IMO, this is overkill. And it's not an option for many people.

For instance, I often send and receive pictures with my friends and relatives. I also send and receive Microsoft Office documents all the time as a part of my job.

Fortunately, it is easy to spot executable attachments with most mail programs. Look for a MIME type like application/octet-stream (a generic binary file, usually used for program files), or application/vbs (Visual Basic Script), etc. And look for file extensions like .exe, .vbs, .com, .bat, .pif, etc. If you have Windows configured to hide extensions (the factory default setting), change that configuration so you can see them.

As a second line of defense, get a good virus scanner (most people I know use either NAI/McAfee or Symantec/Norton) and keep it up to date. Updates come out frequently - sometimes more than once per day. Antivirus packages all include an auto-update facility where they will periodically download updates from the publisher's web site. Home editions of these program require you to buy annual subscriptions to keep getting updates, while corporate editions typically do not.

Non-virus E-mail security

In addition to viruses, there are a few other potential security risks to e-mail that some programs make you vulnerable to.

For instance, HTML e-mail. HTML is useful and cool. It lets you send mail with nice formatting, colors, fonts, images, etc. You can also include links to remote sites, and have remote references to objects on web servers (like images, sounds, etc.)

The problem is that this can create a security problem. For instance, suppose I send you an e-mail with a reference to an image on my web server. You open the mail, and your mail program fetches the image from my sever. You see the image and all's well.

Now suppose I'm a spammer and do the same thing. You think "no big deal" and just delete the spam. But I own the web server. Suppose I send out a million spams, and that image-reference has a slightly different name in each one. I keep a list of which e-mail addresses got which image-references. I can look at my web server's log file and find out which of those image-references were used to download images, match them against my list, and bingo! I now know which people actually read the spam (as opposed to those that deleted it without opening, or those that never received it.) Since I know somebody's reading spam at that address, I'm going to start sending him lots more.

Some mail programs and web sites (like Thunderbirdand Yahoo) provide options to block all remote-image references that appear in mail. This keeps the spammers from knowing that you've read their spam.

Also, HTML e-mail can contain Java applets and JavaScript. These are normally not dangerous, but there have been bugs that allow them to be used for spreading viruses. But they can sometimes open network connections to a remote web server, where they can alert a spammer that his mail has been read.

Fortunately, good mail clients let you disable Java and JavaScript in e-mail as well.

Finally, e-mail may contain data for popular plugins, like Shockwave Flash files. Most plugins are reasonably safe, but some are not. And some of the safe ones can open up network connections, which can alert a spammer that the spam has been read. Again, good mail clients let you disable plugins from e-mail.

Of course, you do not want to have your mail client set to automatically generate return receipts, even if you receive mail that asks for them. Again, this will alert spammers that someone's reading the spam. If you want your e-mail client to generate receipts, configure it to ask for confirmation first, so you won't send it to spammers.

And NEVER send mail to a spammer's "unsubscribe" address. If you do, you'll give him concrete proof that someone at your address is reading the spam. You'll end up getting more spam, not less.

Mail client recommendations

WRT pine, I can't help here. I haven't used pine in a very long time, and I didn't bother to learn much about it back then.

FWIW, I run Thunderbird, from the Mozilla group. It has many good anti-spam features (disable Java, disable JavaScript, convert HTML to plain-text, don't load remote images, and self-learning spam filters) that I find very useful.

Microsoft has put some of this into the newest versions of Outlook, but existing copies leave a lot to be desired in this department.

People who just don't get viruses

In the "I don't get viruses" department, it's true. Some people don't get them. But if anyone says that they can't get them, they're just lying.

A savvy Windows user can almost always eliminate viruses. You can use a mail client with good security in its design. You can install a virus scanner set to scan all files and have it auto-update on a daily basis. You can turn off unused network services. You can use an intrusion detection package (like ZoneAlarm) and you can use a firewall on your network.

But even with all this, it is possible to get a virus. Everybody's human and it is always possible that someone may trick you into running an infected program.

There have even been cases where a software publisher has been infected, and the virus spread through CDs bought in stores. I, personally, have been infected by a virus that came in through Microsoft's "Windows Update" server. But if you stay alert and make sure your virus scanner is always running, you can reduce your risk to a minimum and minimize the damage when something hits.

People using other operating systems can afford to be a bit more cavalier. There is a certain amount of "security through obscurity". People don't bother making many viruses for Linux, Mac OS, OS/2, BeOS and other low-popularity operating systems. Not because it's impossible, but because such a virus won't spread very far. If I infect every Mac that exists, I only get 3-5% of the computers in the world. If I infect 10% of the Windows machines, that's 9.5% of the world. If I infect every OS/2 system that exists, I probably get only a fraction of a percent of the total amount of computers.

In other words, writing viruses for Windows gives the greatest bang for your buck.

10-15 years ago, when most computers on the internet were university mainframes, you found a lot more UNIX-based worms. But now the quantity of UNIX boxes on the internet are dwarfed by the number of Windows PCs attached to DSL lines and cable modems. And these PCs are every bit as connected as those university mainframes used to be.

It is definitely possible to write a virus that targets Mac OS, Linux, or anything else. And even though these viruses may require administrator access to do real damage, I'm sure that lots of users could be conned into typing in their administrative passwords, just like Beagle/Bagle got lots of people to manually decrypt a zip file in order to run the virus. And I'm sure lots of Mac/Linux home users run logged in as root or administrator accounts (just like most Windows NT/2000/XP users do their work from administrator accounts.)

If Linux or Mac OS or anything else should someday become really popular, and not just niche products, I have no doubt that we'll start seeing lots of viruses that target these platforms. These operating systems may have security features that make it harder for viruses to auto-install, but as long as we have gullible users that do whatever random e-mails tell them to do, viruses will remain a fact of life.

And, of course, this is ignoring viruses that are scripts carried in documents (like MS Office documents). These can execute on Macs, just like on Windows, since the Mac version of Office uses a compatible scripting language.

Common sense security

This is based on a comment I made in the MacBytes forum. It was in response to an article about Mac OS security, but is equally valid for everybody.

---

All security for all operating systems must start and end with the user. If the user is knowledgeable and vigilant, then most security products are unnecessary. If he is not, then no amount of add-ons will protect him.

I use a wide variety of computers at home and at work, running a wide variety of operating systems, including Windows. I employ the following security measures for all of them:

• The networks (home and work) are behind hardware firewalls. The home LAN is behind a Linksys router with NAT turned on and all but one inbound port (SSH) blocked. The corporate LAN has its own firewall, administered by the IT department.
• Operating system software is kept up to date with all the latest patches. I use the auto-update facilities to inform me of updates, but not auto-install them. (I want to know what and when I'm installing these patches, even if I end up installing them all.
• I keep my applications (especially internet-using ones) up to date with the latest patches from their respective vendors.
• I only install software that I purchase or download from well-known sites. This is almost always the publisher's own site or a genuine not-pirated CD.
• I do not trade "warez"
• I do share my disk volumes over the LAN, but with some restrictions. At home, all volumes are exported as read-only (if I need to put a file on another computer, I log-in locally to that computer and use the network to fetch it from the file's source computer, which also exports its volumes as read-only.) At work, I use our network's domain-level security so that only my personal account can mount one of my volumes read-write - other domain users are read-only, and guest-access is blocked.
• I disable auto-installation in all programs, including web browsers, games, and the OS itself. I will let apps notify me when updates are available, but I must always give approval before download or installation. When stuff has certificates (like Windows updates), I review them to make sure the files come from where they are supposed to be coming from.
• I never run a program e-mailed to me. Never. Even if the message is expected and comes from someone I know, I won't trust it. If I want someone to give me a program (which happens very very infrequently), I'll have him put it on a known web server and send me a URL to it, or (even better) snail-mail me a CD or load it into a flash drive I always carry with me.
• I don't use known-insecure programs (like Outlook)
• I configure my e-mail program (Thunderbird) to disable plugins, Java and JavaScript. Remote images are blocked.
• Whenever possible/practical, I work from non-administrator accounts. Unfortunately, this usually isn't practical for Windows systems, but it is no big deal on other systems (including Linux and Mac OS.)

Note that none of these procedures require the purchase of any special software and none require the overhead of background software.

I do keep a virus scanner (provided by my employer) running on the Windows PC's just in case something should slip by my procedures. (The scanner updates itself every day at 1:00am and scans the local hard drives every day at 2:00am.) To date, I have gotten exactly one virus over the entire time I've had computers attached to the internet (which is as long as the internet has existed.) And this virus arrived via Microsoft's own Office Update server.

I also run AdAware and SpyBot S&D to scan for spyware on the PC's. I run these scans infrequently, but they have never found anything more intrusive than tracking cookies in my web browsers. (Which I make no attempt to block - I don't consider cookies a serious threat.)

I run the Microsoft software firewall on my Windows XP boxes, but I do not normally run software firewalls on any other computers, preferring to rely on the LAN's hardware firewall. I do keep a copy of Zone Alarm installed, but disabled on Windows laptops - I enable it when traveling in case other networks don't have proper firewalls in place.

Sometimes people ask if I should run antivirus software on my Mac. I tell them what I just wrote above. With proper security procedures, a virus scanner should not be necessary. If the Mac should ever become a target of intense malware activity (like Windows is), I will probably invest in antivirus software "just in case" it should be needed, but I intend on waiting until then.

Why corporate IT is melting down

This week, Winn Schwartau writes in his Security Awareness blog about why Windows is such a mess and why it has to fail:

http://securityawareness.blogspot.com/2005/08/mad-as-hell-xiii-reprise.html

In a comment on this article, I wrote about what happens when corporate idiocy is then combined with the WinTel problem of cheap PC's and bug-ridden software.

I think this comment is worthy of an article in its own right, so here it is, in an expanded form, since I can write more here than on a comment page.

---

It is human nature to not want to admit error. It is the nature of bureaucracies to flat out refuse to admit error, no matter what the cost. They would rather run the entire corporation into bankruptcy than do something that would be an admission of error. And this is with good reason. The one who admits a mistake gets blamed for everything that goes wrong, even if the mistake wasn't his decision and even if the things going wrong have nothing to do with the decision. People get fired from their jobs for admitting mistakes. People get blacklisted from whole industries if they admit mistakes in public.

This, in itself, is a disaster that affects most corporations. Now guess what happens when you get an IT department involved, an aging infrastructure, and a budget crunch.

Initially, everything is running smoothly. The corporation is using big iron for everything important. This is probably some combination of mainframes, minis, workstations, etc. PC's are used, but not for anything more critical than as terminals for accessing the equipment in the machine room. The equipment works well. Partly because very expensive equipment is designed better, partly because it is easier to design and test software when the hardware configuration is carefully controlled, and partly because the number of computers is small enough for the IT department to be able to support.

This all works great until the big iron starts costing too much money. Maybe the electric bills are too high (some old mainframes draw a LOT of power!) Maybe some parts have broken and need replacement. Maybe the annual maintenance contracts are getting too expensive. Maybe the manufacturer is dropping support for the old equipment. It could even be something as trivial as needing more hard drives.

At this point, the IT department is doomed. They would like to buy more of the same. Add more memory/disk to the mainframe. Replace one cluster of minis with the newest model. Move to the latest system software. Ideally, they want to keep everything exactly the way it is. But their bosses won't stand for this. They know an upgrade is needed, but they don't want to spend the money on new big-iron. They look through the latest Dell/Gateway/HP catalog and see that PC's cost $500 each, and PC servers cost $5000 each. They order the IT group to replace the mainframes with a network of PC's.

Sometimes, an IT manager can fight this. Most of the time, he doesn't dare. He can be fired and replaced with someone who will tow the corporate line. The decision has already been made, and made by people with absolutely no expertise.

So the PC's are installed everywhere. The IT managers get bonuses for saving money (if they can make their bosses believe the move to PC's was their idea), and the executives consider the case closed. Everybody pats themselves on the back for a job well done (except for the IT people who know exactly what's about to happen - usually the help desk staff.)

Soon, the PC's start failing, or other weird problems start happening. Users have random system crashes. Unwanted programs (spyware, viruses, worms, etc.) start installing themselves all over the place. Users bring programs in from home, even though there may be a policy forbidding it.

The IT help desk does their best to keep everything running smoothly. They patch, clean, upgrade, and reinstall the PC's as necessary. But the problem doesn't ever go away. This is partly because the hardware is cheap junk. Partly because individual (usually untrained) users are doing their own system maintenance (even possibly against corporate policy). Partly because hackers and script kiddies attack Windows far more often than any other system. Partly because the IT staff has not been properly trained to transition from mainframe maintenance to Windows maintenance. And partly because Windows really is very insecure and very expensive to maintain in a large networked environment.

So the users start complaining a lot. The IT help desk gets swamped with calls. There is never enough money in the budget to hire more help desk staff. Help desk staff burn out and quit and have to be replaced with new staff that don't have sufficient training. This forces the help desk to start using handbooks instead of analysis in order to keep up with the calls, degrading the quality of support and making users even more angry.

IT clamps down on security by installing draconian firewalls and proxies throughout the network. They lock users out of their own PC's in order to restrict who upgrades what. They download and test/review every patch from Microsoft and push the updates onto user's computers over the network.

But this isn't fast enough. Soon a virus arrives and trashes the network. It takes weeks to fully recover. Word gets around that Microsoft actually had a patch available to fix the security hole that the virus used, but it wasn't deployed across the corporate network. Because IT hadn't yet tested the patch against all the corporate software. Those users who had hacked their way around IT's restrictions and installed the update anyway, of course, weren't damaged by the virus.

In order to prevent this from happening again, IT turns on Windows' auto-update facility, where patches are automatically downloaded from Microsoft and installed. This prevents a recurrence of the problem, but it also eliminates any semblance of control over the network. IT no longer knows what system software is running on the PC's. Some patches will break applications, and IT won't find out until after users complain about the broken apps.

The situation spirals further and further out of control. Ultimately, the entire IT department is little more than a group of highly paid errand-boys. All of the real system maintenance is being done by the software vendors through automatic updates. The IT people will run cables and replace broken hardware, but they end up powerless to do anything else. The help desk tries valiantly to make the best of the situation, but ultimately, they are powerless to do anything more than chase down symptoms, read scripts, and apologize a lot.

Some people in IT see this happening and they know exactly why. They know that they need to get rid of the PCs and consolidate control back in the machine room. But the reasons for getting rid of the big iron (high cost) still exist, and executives refuse to include in-house support as part of the cost of running a PC-based network. And he who admits an error gets blamed for it. And users won't want to give up the freedom they were given, even if that freedom is clobbering their ability to do their jobs.

And, of course, the executives will say something like "Everybody else has switched over to PC's and they're doing fine, so the problem must be with you and your staff." Completely ignoring the fact that everybody else is also melting down and refusing to admit it.

Which is where we are today.

Virusses, start your engines

Microsoft's public beta for Vista (their next generation of Windows) has been out for only eight days when someone has already written a virus for it.

Does anybody seriously think Microsoft knows or cares anything about security when things like this can happen?

I do find it a bit amusing that most people haven't bothered reporting this. Apparently everybody just expects Windows to be full of virusses, so one more really means nothing.

Microsoft's "Blue Hat" security conference

Microsoft recently ran their "Blue Hat" security conference, where hackers and MS employees were able to meet and discuss security issues.

During the conference, some of the guests successfully hacked some of Microsoft's demo computers, much to MS's embarrassment.

But to MS's credit, they appear to be willing to work with the security experts to get these problems fixed.

If we're lucky, this event will be the kick in the pants Microsoft needs to start really securing their software.