At Mobile World Congress (MWC) in Barcelona, there are eight huge halls, not to mention the vendor-decked hallways, plus another sub-convention center to visit. Mobile World Domination is a better word for the event. I’m reminded of the old days of CeBIT where 800,000 people made it to Hannover, Germany, in the late 1990s and early 2000s.

No more.

The GSMA has adroitly herded all things mobile to Barcelona instead. The recognizable big guns are here, minus a large Microsoft presence, and Apple is the invisible 800-pound gorilla.

To read this article in full, please click here

I have a Macbook Air, purchased from the Apple Refurb store about two years ago. It now has a dead key. It’s the S key. 

After cleaning it with compressed air, it worked badly for a while and is now dead. A query to the local Apple repair shop indicates it’s fixable for about $380. One look at the iFixit repair PDF, and it’s easy to see that it’s very labor intensive. For. One. Key. 

I obtained an appointment at the area Apple Store Genius Bar. After about 40 minutes, it was determined that Apple could repair my MacBook Air. The price would be $475, but that would include other refurbishments as determined at the time, perhaps including a new battery or whatever else was found “wrong” with the machine. 

To read this article in full, please click here

MongoDB wasn’t the first database hit by ransomware, just a rich target for attacks. Now, ElasticSearch and Hadoop have become ransomware targets. They won’t be the last. Were these three database products insanely simple to secure? Yes. Were they secured by their installers? Statistics and BitCoin sales would indicate otherwise. 

And no, they won’t be the last. Every hour of every day, websites get pounded with probes. A few are for actual research. When the probe is a fake logon, like the dozens of hourly WordPress admin fails I get on my various websites, you have some idea that the sender isn’t friendly.

To read this article in full, please click here

I’ve been covering Microsoft Windows since the 1980s. There have been several regime changes, each with its own distinct ego. Some regimes listened eagerly, some didn’t. This one is failing, but I believe the current fingers-in-the-ears stance are related more to revenue than to ideology. 

Microsoft wants data about you. To do so, Windows 10 is riddled with phone-home messaging. Some sites document dozens of IP addresses and add even more DNS calls for your machine’s data. 

We’re told that the data isn’t personally identifiable and that it’s used to improve QA. No one said Microsoft didn’t need QA. New versions of Windows have always had holes big enough to fly airliners through, but Microsoft finally got some sense when in Windows XP SP2 and Vista, they demoted user space. Finally. 

To read this article in full, please click here

Many of you are on Wi-Fi, but this is salient to you. 

Amazon’s enormous sales site is marketing Cat 5 and Cat 6 Ethernet cable with aluminum conductors, as well as “plenum-rated” cable that bears no UL markings and is likely fraudulent. This comes after a run of apparently bogus Apple chargers and cables. 

Why do you care? Several reasons: 

1. Some of the Ethernet cable sold uses either copper-coated or copper-mixed aluminum. Numerous specs call for the conductors to be solid copper. Why? Copper meets conductivity specs and won’t heat up under load.
2. Organizations using Power-over-Ethernet (PoE) to power remote Wi-Fi access points (quite common these days) risk having the cable catch fire due to overheating, or just melt and short—especially on long cable runs.
3. Plenum-rated cables are self-extinguishing. This means if you put a nail through one (we hope accidentally), then a jacket surrounding the cable prevents setting something in the surrounding area on fire.
4. If you add the two factors together, cable that heats up and jackets that don’t extinguish a possible flame, then the sprinklers turn on. We hope. 

Whilst perusing the listings, I came across numerous enticing examples. Why enticing? Because their cost is perhaps half, even less, of products that do meet the specifications. 

To read this article in full, please click here

If the cloud is real, software important, and system reliability paramount, then non-stop computing, computing across time zones, and invisibly short repair times ought to be mandatory, wouldn’t you think? 

Of many requirements lain in litigation, regulatory compliance, and other “best practices,” there is one that doesn’t seem to make the checklists. 

Let me lay it out for you: 

Can you get support 24/7/365.25?

You get bonus points for knowing leap seconds are coming. Why? Because among other things, Kerberos time synchronization mandates pretty accurate timing. We’re about to insert a leap second into your life on western New Year’s Day. You may have zones that celebrate other years, but to be in sync with the time standards in the United States, there will be an extra second. The earth is slowing down. 

To read this article in full, please click here

I’m a Zen heretic, and so also is my sense of systems security.

A very cogent citation describes the folly of it all. The people who install toolbars, click on random stuff and feel like they won something when they downloaded the free app are too plentiful, and security is too tough to understand—even PGP. 

Bringing up the bottom is as important as extending the top. We don’t ritualize security because that would be too tough, to impolite to do. Your mother did not teach you to use complex passwords and to change them as frequently as your underwear. Given some people I know, it’s a wonder they passed the “p@55w0rd” rubric they were trained to use.

To read this article in full, please click here

IoT, rotten home AP firmware, freaking Wi-Fi cameras: They’re all eating your lunch. Here’s an Advanced Persistent Threat notice: EVERYTHING AROUND YOU can give you a miserable day. 

It’s now entirely myopic, and hence irresponsible, to think there is such a topic as enterprise security because sadly video cams in Macedonia can give your hosting environment a DDoS headache. 

Poor TLS handshakes crack browsers open like an egg. 

Your router vendor had all of the hardening of a “fairy tap.” Remember those when you were a kid? A fairy tap was a gentle touch, designed to invade your space but do no damage. Now the damage is pOwn1ng your infrastructure. Or you business partner’s infrastructure. 

To read this article in full, please click here

For some companies, using cloud services isn’t what they hoped or expected it to be. Reason’s like these might be enough to make them leave. 

1. Your costs went out of the control. 

This can be significant. Prices go up and go down. A new product gets introduced that might be more financially attractive—but only if you started from that point and not if you include the added cost of migration (documentation, security and other audit) not to mention re-budgeting and rate of return over the lifecycle of the data flows. 

2. Security was tougher than you thought. 

You were probably smart and already had extensive key control, but perhaps your cloud vendor wanted it done their way. Asset control, the cost of embedding security control planes and audit infrastructure that duplicates data center standards created a duopoly of security infrastructure—perhaps both equal but not the same—adding to costs of control, training, documentation, audit and more. 

To read this article in full, please click here

Yes, I was hit last week. Forensics are in progress. I got doxxed, too.

It has made me realize that most of systems security is an illusion. Here are my favorite alternate realities:

1. Everything is safe behind the firewall.
Ever heard of UBFWI—as in User’s Been Fooling With It? While IPD/IPS and firewall networked-technology has improved so vastly, there’s nothing like a user with an infected laptop to bring in a lulu.

2. Obscure operating systems never get hit. Hackers only go for the gold with Windows.
Here, let me laugh out loud and roll on the floor. Mine was an obscure server version on an obscure branch of an obscure BSD limb. Listen to the sound of lunch getting eaten: mine. Chomp, chomp, burp.

To read this article in full, please click here

You want to be more responsible about IT security in your organization, but where do you start? May I suggest your first step be understanding these topics more thoroughly. This is list isn’t exhaustive. It’s only a beginning:

1. DNS and DNSSEC: The biggest games in cyber war are hitting DNS providers. DNS can be compromised in many simple ways, but Domain Name System Security Extensions (DNSSEC) thwarts these—at the cost of understanding how it works, how to deploy it and how it’s maintained. There are ways to understand if your own organization is threatened with DDoS attacks. Study them. 

To read this article in full, please click here

Update: It was reported Sept. 27 that a near terabyte/sec attack was foisted on hosts of Minecraft servers in the first thermonuclear attack on U.S. servers. Who's next?

----------------------------------------------------------

Does the thought of 600 Gbps-plus of traffic hitting your URLs excite you? Do you get tingles up and down your spine thinking about watching your line of business apps frying? Perhaps that wonderful text, where an alert from your financial processor says “We’ve gone black, again, and expect to be back online perhaps maybe possibly tonight” thrills you.

To read this article in full, please click here