Stuxnet and You

There’s a new computer virus out there called Stuxnet. While I sometimes post about new computer viruses that can mess up your system, this one actually won’t. Because it’s not your average virus. This one wasn’t written by a lovesick teenager trying to impress a girl or Russian mobsters trying to extort a few dollars from you. No, Stuxnet is something else entirely. This virus is looking for one particular computer, and like The Terminator, it won’t stop until it finds it.

The virus is typically transmitted to Microsoft Windows computers via infected USB sticks. But the virus isn’t looking to infect Windows. It’s actually looking for a particular kind of Supervisory Control and Data Acquisition (SCADA) software built by the German industrial giant Siemens. This software is used to run industrial facilities like chemical and power plants. Once Stuxnet finds such a controller, it checks the SCADA software every five seconds to see if it’s the particular computer it’s looking for. If not, it simply does nothing but check again every five seconds. If it does find the computer it’s looking for… well, we don’t know what it’s programmed to do, but we know that it would execute certain commands, commands that would probably physically destroy the facility by opening valves or pipes or overloading turbines until something exploded.

Although the virus uses Windows to move from facility to facility, it should be noted that the hardware and software it’s targeting are proprietary to Siemens. This isn’t off-the-shelf stuff the virus is attacking. Whoever is behind the virus attack has deep pockets and really wants something destroyed… and that something is probably in Iran. And it’s probably the facility where nuclear weapons are being developed.

We don’t know enough about the origins of Stuxnet to say whether the CIA, Mossad or MI-6 is behind it… but we do have a precedent from the waning days of the Cold War.

Continue reading “Stuxnet and You”

COOL APP: MozBackup

I got my current computer as a Christmas present in 2008. At the time, I didn’t have a copy of the installation media for x64 Vista… so I couldn’t do the “reformat the computer to clean off all the crud HP installed on it” thing like I normally would. And by the time I did have a copy of the media, I was so far along that I didn’t want to do the reformat. I then did an in-place upgrade to Windows 7 back in October 2009. Over time, several niggling (but hard to diagnose) issues cropped up, and this past weekend I reformatted the old gal and started over.

Like most folks, I do a lot of stuff on the Internet. And nothing is as important to me as my Firefox profile. Not only do I have saved passwords and a browsing history to keep, I also have tons of extensions and UI tweaks that would take forever to redo. That’s why I fell in love with MozBackup:

mozbackup

As the name suggests, MozBackup backs up your entire Firefox profile to a single, handy file. It’s a stand-alone app that requires no installer: just download, unzip and run. The entire process of backing up your profile only takes around 6 mouse clicks, and restoring everything about your browser takes just 6 clicks more. And not only did MozBackup restore the stuff I expected it to, it even restored all of my GUI tweaks after the reformat!

MozBackup works with Firefox, Thunderbird, Sunbird, Flock, Postbox, SeaMonkey, Mozilla Suite, Spicebird, Songbird, Netscape, and Wyzo and is freeware (even for commercial use).

Check it out here!

Charlotte TWC Customers: Check This!

A week or two ago, Time Warner robocalled the house during the day, saying that Internet and digital phone services might be disrupted that night, as they were “implementing some upgrades that will make your Internet service faster in the future”.

Our Internet service didn’t go down that week, but it did go down last night. I became curious about the outage, as it started almost exactly on the hour, and lasted almost exactly one hour. Once the service came back up, I went to Speedtest and checked my speed:

New Speed Test

HOLY CRAP! We have basic Road Runner service, and had been getting 7Mbps/364kbps before. Now it seems that were getting almost 20Mbps down… WOW! Too bad the upload speed remains a pokey 384kbps!

So if you’re in the Charlotte area (and specifically Gaston County, which is a different TWC franchise from Meck County), check your Internet speed… it just might be a whole lot faster!

WinXP: Deleting Cached Credentials

I came across an interesting problem the other day. A client had a user who was out of the office. The site administrator changed the user’s AD password, but the user was still logged in to her desktop computer under her old credentials.

The next day, the administrator went to the user’s computer to check an email, and she received the expected “invalid credentials” error message. Following the onscreen instructions, she locked the computer and unlocked it using the new password. This “worked”, in the sense that the password was accepted by Windows XP. But she was prompted for a password when opening Outlook and got a “access denied” error message when accessing network shares.

She called me, and I advised her to log off and log back on the computer. When this didn’t help, I had her reboot the computer. When this didn’t work, I accessed the computer remotely and tried logging in as that user.

I logged in using the new password, which Windows XP happily accepted. However, the login script hung on an “invalid password” error and I too got “access denied” messages when accessing network shares. But what was strange is that the login script accepted the username and new password when entered manually.

I figured something must have been screwed up with the user’s cached credentials, so I clicked Start > Run and typed the following:

rundll32.exe keymgr.dll, KRShowKeyMgr

This opened a window with the user’s cached credentials. I could have clicked “Remove”, but instead I clicked on “Properties” for the domain credentials and put the new password in.

And everything started working again.

WTH MSFT?

I downloaded the Windows Live Essentials beta the other day, because I wanted to take a look at the Windows Live Photo Gallery software, which is, by all accounts, a great piece of software.

Like a lot of installers, the Windows Live Essentials software wants you to shut down other programs whilst it installs. Unlike other software, however, the list of “open programs” that the installer wanted to shut down was pretty ridiculous:

msft_wtf_web
(click to enlarge)

Man, I get that this is beta software and everything… but shutting down the DHCP client and Print Spooler? The Workstation service? Really?

Windows Vista: Making a “Universal Install” Disc

In this post, I showed you how to make an “universal install DVD” for Windows 7. In a nutshell, by deleting one file from a Windows 7 install DVD, you can have the edited disc prompt you for which version of the OS you want to install. You can’t use this tweak to get free upgrades – the version you can use is tied to your product key – but the tweak comes in handy for IT support staff who might need to install many different versions of Windows.

I have found a similar tweak for Windows Vista, and it works in a similar way:

1) Using a disc imaging utility like PowerISO, make an image of the Windows Vista installation DVD.

2) Extract a file called SETUP.CFG from the “Inf” folder inside the “Sources” folder in the root of the drive image.

3) Open the file with a text editor like Notepad and scroll to the bottom of the file. There you will see something that looks like this:

[DefaultImageSelection]
Value=VFWBB-HAJJV-G996G-QWGJY-2V7X9

4) Delete these two lines and save the edited file, then overwrite the existing configuration file in the ISO image.

5) Burn the edited ISO to disc.

When you run setup using the edited disc, do not enter a product key when prompted; on the next screen you will be asked which version of Vista you want to install. You can then enter the product key after setup completes.

The only “gotcha” to this is that I’m fairly certain that you need a Windows Vista Ultimate disc to create the ISO, as Vista Ultimate is the only one that contains all the installation files for every version of the OS.

Securing Wi-Fi: What NOT to do

Quick: what do MAC filtering, disabling DHCP, and disabling SSID broadcasting all have in common? They’re all terrible ways of “securing” your Wi-Fi network. This article over at ZD Net explains:

These aren’t layered approaches; they’re more like buying overlapping warranty coverage, since any benefit against casual bandwidth thieves is already covered by real security measures. The harm is that people confuse these methods for the real thing, and they spend more money and resources on implementing the wrong security mechanisms and end up skimping on real security.

Amen! Preach it, brotha! As I’ve been trying to tell armchair security experts for years, things like MAC filtering and disabling DHCP only make hacking slightly more difficult for hackers and significantly more difficult for both guests and regular users.

Just use a long random password under WPA2-AES and you’ll be fine. I promise.

CHKDSK runs at boot

If you shut down your computer incorrectly, it’s likely that CHKDSK (Windows disk checking utility) will run the next time you boot your computer. It’s not exactly common, but it’s not unheard of for Windows to then get “stuck” and want to run CHKDSK on a disk every time you start your computer. What’s worse, if Windows wants to run CHKDSK on a system drive, you might get locked out of your computer: Windows will run CHKDSK on the system drive, then reboot, then run CHKDSK again, then reboot, then run CHKDSK and reboot… and on and on and on in an infinite loop, and you never get to the desktop.

Yesterday, I was surfing the topics at a popular message board, when I came across a user who complained that CHKDSK was running at every boot on an external drive attached to his computer. The disk came up clean every time, but it was annoying to have to sit through the unneeded disk check every single time he booted his computer.

A poster suggested that he run the following command:

chkntfs /x d:

This is a horrible idea. It permanently disables automatic disk checking for that volume. While it will indeed solve his immediate problem of Windows checking the external drive at every boot, it also prevents Windows from checking the disk for errors in the future. It’s like suggesting that the best way to fix a video driver issue is to turn off the monitor!

A much better solution would be for the user to start REGEDIT and look in the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\Session Manager

Look for the BootExecute entry. By default, the value should be autocheck autochk *. If it is not, change it back to autocheck autochk * and reboot. Problem solved!

QuickJava Updated

From the “I shoulda posted this a month ago” department:

QuickJava, one of my favorite Firefox extensions, has recently been updated.

Quick Java

Aside from the snazzy new buttons, you can see that QuickJava has also added support for toggling images, Flash and Silverlight objects on and off, in addition to its namesake Java applets and JavaScript objects.

Download QuickJava here.

Restore Points on Demand

I like to tinker with my computer. That doesn’t just mean installing all sorts of programs and utilities from all over the web – it also means changing registry settings, occasionally replacing system files, and other “behind the scenes” tweaks.

I’d normally like to use System Restore to create a restore point before tweaking, in case something goes horribly wrong. Unfortunately, Microsoft made it so that doing so requires drilling through several menus. Sometimes I don’t feel like clicking 19 things to create a restore point for something I might not even need, and one day that’s going to bite me in the ass. I found several Visual Basic scripts on the ‘Net that claimed to offer such “on demand” functionality, but every single one of them generated some arcane scripting error that I didn’t feel like tracking down.

So imagine my joy when I found Quick Restore Maker. It’s a tiny executable that generates a restore point with a single click! So you can keep a shortcut to it on your desktop and easily generate a restore point before tweaking away:

quick-restore-maker

Quick Restore Maker is for Windows Vista and Windows 7 and is free.