Dan Lohrmann: October 2008 Archives

Urgent Security Update for Windows

Government technology teams and contractors were scrambling late Thursday and Friday to apply an urgent Microsoft security patch which was released "out-of-band" (or outside the normal "patch Tuesday" schedule).

The Microsoft website offered details of how to get the updates.

Computerworld offered two stories related to the critical new vulnerability. The first story described attack code for critical Microsoft bug, and another article released on Saturday described how the Gimmiv worm feeds on latest Microsoft bug.

Microsoft released the patch two weeks prior to the normal schedule, since they were seeing active attacks on the Internet. According to Computerworld:

"Both Symantec and McAfee Inc. said today that they had seen only a very small number of attacks based on this exploit, but Symantec says that, starting yesterday evening, it found a 25% jump in network scans looking for potentially vulnerable machines. That could be a sign that more attacks are coming.

That scenario becomes more likely, too, as more tools that exploit the flaw are released to the public. Sample exploit code was posted to the Milw0rm.com hacker site today, and over the next few days hackers are expected to move that code into attack tools that are easy to use."

Some experts were predicting that the attack code will soon be used to build botnets with infected computers. What is clear is that all governments need to respond immediately and apply the patch, if they haven't already done so last week.

Has anyone seen this attack on their networks? 


Over the past month, the Pew Internet & American Life Project  has released the results of several new polls on how Americans use their technology. The latest report, Networked families, describes the central role now played by the Internet and cell phones:

"The survey shows that these high rates of technology ownership affect family life. In particular, cell phones allow family members to stay more regularly in touch even when they are not physically together. Moreover, many members of married-with-children households view material online together."

A report released last month on work called Networked Workers, describes how pervasive the use of the Internet has become in the United States.

"The majority of employed adults (62%) use the internet or email at their job, and many have cell phones and Blackberries that keep them connected even when they are not at work."     

There is good news and bad news in these reports and poll numbers. Most workers think that increased connectivity makes them more productive, but the majority also think that these tools also add stress and new demands to their lives.

Digging deeper, Pew has two separate reports regarding work. One covers Email at work. Again, respondents recognized the good and bad aspects of email. Interestingly, the polls show that spam is less a problem at work than with personal email accounts.

Another report covers Wired Workers: Who They Are and What They're Doing Online. There are many positive aspects to this report, as well as a darker side mentioned.

"Some 17% of Internet users (and 11% of all Americans) say they know someone who has been disciplined or fired because of his or her use of the Internet on the job." 

 In my opinion, coverage of these reports has been somewhat limited, probably due to the coverage on the upcoming election. Still, there was some mainstream press coverage. USA Today offered this report back in September: Study: American workers tethered (with mixed feelings) to work via tech. One man who was interviewed for the report said,

"If everybody also threw their BlackBerrys away, I would too," he said, chuckling. "The only problem is, in my industry, it makes me more competitive."

Initial coverage of family use of the Internet has been more positive. CNet claimed, "The Internet is no 21st-Century Boob Tube."

Overall, there weren't many surprises in these new poll numbers or Pew reports. One thing to keep in mind is the law of averages. That is, some people are spending much more time online than these numbers indicate. (Of course, others are spending significantly less.) Still, there were no shocking numbers that grabbed headlines nation-wide.

I plan to discussing these poll numbers further in future blog entries. Meanwhile, what's your opinion on these reports? 

 


USA Today and other media outlets are reporting that the Federal Authorities have shut down a massive international spam operation.   

The Federal Trade Commisiion (FTC) website listed details of the story this afternoon:

"According to papers filed with the court, the defendants recruited spammers around the world to send billions of spam messages directing consumers to Web sites operated by an affiliate program called "Affking." By using false header information to hide the origin of the messages, failing to provide an opt-out link, and failing to list a physical postal address, the defendants violated the CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) Act of 2003.

Some security researchers believe that at one time, nearly one-third of the world's spam e-mail came from a network of compromised computers, often referred to as a 'botnet,' that sent spam promoting the defendants' Web sites. Their enterprise included participants in Australia, New Zealand, China, India, Russia, Canada, and the United States."


Google has announced a new feature in Gmail that is getting an amazing amount of media coverage world-wide. ABC News called it a breathalyzer to stop drunken emails with math in an article called Think Before You Drink and Draft.  Here's an excerpt:

"You know you shouldn't do it, but that liquid courage convinces you otherwise and, soon enough, you've fired off a hasty e-mail to an ex, a co-worker or, worst of all, a boss.

Many a relationship has been prolonged -- and perhaps many a career has been cut short -- by the dreaded drunken e-mail."

At first, I thought this was a bad joke. Was Google trying to add some comic relief to our lives? Could this be an attempt to change the subject away from our 401Ks and our current Wall Street banking woes?

But I kept running into this story all week. Some on mainstreet are honestly thinking that this is some type of breakthrough. Even morning talk shows are offering demos on how hard the Google math is.  The Internet has plenty of video interviews on this topic. One video from NBC San Diego can be seen here.

Personally, I find this topic to be beyond humorous. Is this really such a big problem? Will people really use this new feature? Perhaps I'm living on a different planet or not consuming enough alcohol, but are millions of cyber surfers really drunk? 

OK, I'll try and offer some serious commentary on this new development.

The Problem: Sure, people send emails and instant messages in poor judgment. They hit the return button millions of times each day - only to regret the message later. We all need to stop and think before we click. Sometimes these messages are accidental and other times they are intentional but naive or unwise. 

Most people occasionally use the Internet when they should go offline and talk in person. I've intervened in many email wars at work over the past decade between professionals sitting in back to back cubes. This happens even when people are sober.  

The Good: People are finally confronting the fact that there are real-world consequences to their virtual actions. As I've said in several blogs, our virtual worlds and real world events are merging at home and work.

The Trend: Get ready for more technology tools and techniques to build trust online. We have a long way to go in this area. How can we connect our offlines values with our online world? How about a virtual conscience based on your professed values? More accountability must come with more social networking opportunites at work.

The Solution: What we need is cyber ethics for grown-ups. This involves people, processes and technology. Although technology can help (and more tools are coming), no Google or Microsoft tool will do this for you. We're talking about character and integrity in a cyberspace that resembles the Wild Wild West.  I describe this trend and personal solutions in detail in my soon to be released book, Virtual Integrity.

One final thought, Google is very good at marketing and offering what customers want. Obviously, they did some market research before rolling this out. It clearly passed the "cool" or "daily buzz" litmus test. So how can we offer similar security tools that help overcome risk and also meet customer needs at work? There is a lesson in this (somewhere) for IT professionals.

Any ideas on how to make it cool to change your password? Now that would be a breakthrough.       

 

 

 


USA Today is reporting that the Justice Department will charge David Kernell, a 20-year old Tennesee man, with hacking into Alaska Governor Sarah Palin's personal email account.  

The indictment is also available at USA Today's blog site.

According to the Knoxville News Sentinel: "Kernell is the the son of state Rep. Mike Kernell, D-Memphis.... If convicted, Kernell faces a maximum of five years in prison, a $250,000 fine and a three-year term of supervised release. A trial date has not been set." 

 


When I go online, I often check out the headlines and key stories in the United Kingdom (UK). Typically, I visit The London Times. There are many reasons for this such as:

- Our English friends provide a different voice and perspective on world events and on happenings in the USA.

- They are often a few days or weeks (sometimes even months) ahead of us in their discussion of various topics, including technology trends.

- They don't have to be as politically correct - they can call an election or economic event as they see it.   

- Personal preference. I lived in the UK (in North Yorkshire) for almost seven years - I just like the way they think and write across the big pond.

So what have they been talking about lately? Besides detailed analysis on the upcoming US elections, the $700 billion economic bailout and Europe's own banking crisis, one hot topic in their technology section is "The Grid."

Never heard of it? Check out this 4+ minute YouTube video on The Grid.

Europeans think this is a big deal. How do I know? Check out these recent headlines from our scientific colleagues, keeping in mind that these writers are known to play down just about everything: The Grid powers up to save lives and seek the God particle  or Grid of 100,000 computers heralds new internet dawn.  

Here's an excerpt from the first article:

"Scientists believe that the Grid, described as a "worldwide revolution," also has the capacity to find a cure for cancer and save lives following a natural disaster.

Excited researchers, from Vancouver to Beijing and Oxford to Melbourne, watched yesterday's launch at CERN, the European Organisation for Nuclear Research, near Geneva, through a live video link up.

It has been vaunted as the next evolution of the internet and may even allow researchers and pharmaceutical companies to find a cure for cancer faster than previously thought possible. This is because the Grid is able to crunch massive amounts of data very quickly by, in essence, turning a desktop PC into a supercomputer."

There is no doubt that these are exciting times, but many will see these events as somewhat scary or as another step towards "Big Brother." Indeed, other headlines on Sunday, October 5, such as Government will spy on every call and e-mail, highlighted British Government plans to expand monitoring to capture terrorists.

Regardless of our personal opinions, "The Grid" is coming. While Americans spend the next few months focused on important political and economic matters, technology keeps moving. I suspect we will spend quite a bit of time in 2009 and beyond discussing the good and bad impacts to society that the "The Grid" will bring upon us. If, as Microsoft says, we are trying to build "end to end trust" online, there is no doubt that hundreds, perhaps thousands, of articles will be written on this topic over the next decade.  

Some may even say, I heard about this way back in the Spring. True, Fox News ran an article in April 2008 entitled: The Grid could soon make the Internet obsolete. It's a very good article.

But funny thing, it originally came from The London Times.