Dominating the Search Engines for Local Businesses across the US
is Dominating the Search Engines for local businesses across the US
Today's Google Outage - And Who Really Cares?
Let me be the first to say, I was affected by the outage today. For about 4 hours.
My email was completely dead. I could have fired up Outlook, but I chose not to.
I've been on Google's web applications since starting in 2002 with GMail. Calendar, Docs, Spreadsheets as soon as they came out. I barely use my My Documents folder anymore.
I read the news sites tonight, and there's all this hype about "This is a perfect reason why companies won't switch to hosted apps - it's downtime and unreliability."
Let's quickly run some numbers. 8 years of service is 70,128 hours. My GMail ONLY was down for say worst case, 5 hours today. That's 99.9928% uptime.
If you're not familiar with up-time ratings, here's a crash course. The vast, overwhelming majority of web hosting providers only rate their uptime to 99% or maybe 99.9%. Over 8 years, that would be 701 hours and 70.1 hours, respectively. I'd say that's pretty damn good.
Think about your home computer and how often you reboot it. Or it crashes. Or you install some updates or new software and it needs a restart. Or the power goes out. Or it's down for a half-day (or a weekend) for a major upgrade). Or, God forbid, hardware failure. We've all experienced it, and that's all downtime.
Yeah, it was inconveniencing today, but the time Google has saved me over 8 years centralizing all my documents, email, spreadsheets, etc far outweighs the 5 hours of outage. I've had several computer and power failures, and being able to just stand up and move to another computer or location and resume my work has been a lifesaver at times.
My email was completely dead. I could have fired up Outlook, but I chose not to.
I've been on Google's web applications since starting in 2002 with GMail. Calendar, Docs, Spreadsheets as soon as they came out. I barely use my My Documents folder anymore.
I read the news sites tonight, and there's all this hype about "This is a perfect reason why companies won't switch to hosted apps - it's downtime and unreliability."
Let's quickly run some numbers. 8 years of service is 70,128 hours. My GMail ONLY was down for say worst case, 5 hours today. That's 99.9928% uptime.
If you're not familiar with up-time ratings, here's a crash course. The vast, overwhelming majority of web hosting providers only rate their uptime to 99% or maybe 99.9%. Over 8 years, that would be 701 hours and 70.1 hours, respectively. I'd say that's pretty damn good.
Think about your home computer and how often you reboot it. Or it crashes. Or you install some updates or new software and it needs a restart. Or the power goes out. Or it's down for a half-day (or a weekend) for a major upgrade). Or, God forbid, hardware failure. We've all experienced it, and that's all downtime.
Yeah, it was inconveniencing today, but the time Google has saved me over 8 years centralizing all my documents, email, spreadsheets, etc far outweighs the 5 hours of outage. I've had several computer and power failures, and being able to just stand up and move to another computer or location and resume my work has been a lifesaver at times.
Why AT&T Killed Google Voice
Earlier this month, Apple rejected an application for the iPhone called Google Voice. The uproar set off a chain of events—Google's CEO Eric Schmidt resigning from Apple's board, and the Federal Communications Commission (FCC) investigating wireless open access and handset exclusivity—that may finally end the 135-year-old Alexander Graham Bell era. It's about time.
With Google Voice, you have one Google phone number that callers use to reach you, and you pick up whichever phone—office, home or cellular—rings. You can screen calls, listen in before answering, record calls, read transcripts of your voicemails, and do free conference calls. Domestic calls and texting are free, and international calls to Europe are two cents a minute. In other words, a unified voice system, something a real phone company should have offered years ago.
Apple has an exclusive deal with AT&T in the U.S., stirring up rumors that AT&T was the one behind Apple rejecting Google Voice. How could AT&T not object? AT&T clings to the old business of charging for voice calls in minutes. It takes not much more than 10 kilobits per second of data to handle voice. In a world of megabit per-second connections, that's nothing—hence Google's proposal to offer voice calls for no cost and heap on features galore.
What this episode really uncovers is that AT&T is dying. AT&T is dragging down the rest of us by overcharging us for voice calls and stifling innovation in a mobile data market critical to the U.S. economy.
For the latest quarter, AT&T reported local voice revenue down 12%, long distance down 15%. With customers unplugging home phones and using flat-rate Internet services for long-distance calls (again, voice is just data), AT&T's wireline operating income is down 36%. Even in the wireless segment, which grew 10% overall, per-customer voice revenue is down 7%.
Wireless data service is AT&T's only bright spot, up a whopping 26% per customer. How so? As any parent of teenagers knows, text messages are 20 cents each, or $5,000 per megabyte. After the first month and a $320 bill, we all pony up $10 a month for unlimited texting plans. Same for Internet access. With my iPhone, I pay $30 a month for unlimited data service (actually, one gigabyte per month). Is it worth that? The à la carte price for other not-so-smart phones is $5 per megabyte (one-thousandth of a gigabyte) per month. So we buy monthly plans. Margins in AT&T's Wireless segment are an embarrassingly high 25%.
The trick in any communications and media business is to own a pipe between you and your customers so you can charge what you like. Cellphone companies don't have wired pipes, but by owning spectrum they do have a pipe and pricing power.
Aren't there phone competitors to knock down the price? Hardly. Verizon Wireless, T-Mobile and others all joined AT&T in bidding huge amounts for wireless spectrum in FCC auctions, some $70-plus billion since the mid-1990s. That all gets passed along to you and me in the form of higher fees and friendly oligopolies that don't much compete on price. Google Voice is the new competition.
By the way, Apple also has a pipe—call it a virtual pipe—to customers. Its iTunes music service (now up to one-quarter of all music sales, according to NPD Market Research) works exclusively with iPods and iPhones. The new Palm Pre, another exclusive deal, this time by Verizon Wireless, tricked iTunes into thinking it was an iPod. Apple quickly changed its software to lock the Pre out, and one would expect Apple locking out any Google phone from using iTunes.
It wouldn't be so bad if we were just overpaying for our mobile plans. Americans are used to that—see mail, milk and medicine. But it's inexcusable that new, feature-rich and productive applications like Google Voice are being held back, just to prop up AT&T while we wait for it to transition away from its legacy of voice communications. How many productive apps beyond Google Voice are waiting in the wings?
So now the FCC and its new Chairman Julius Genachowski are getting involved. Usually this means a set of convoluted rules to make up for past errors in allocating scarce resources that—in the name of "fairness"—end up creating a new mess.
Some might say it is time to rethink our national communications policy. But even that's obsolete. I'd start with a simple idea. There is no such thing as voice or text or music or TV shows or video. They are all just data. We need a national data policy, and here are four suggestions:
• End phone exclusivity. Any device should work on any network. Data flows freely.
• Transition away from "owning" airwaves. As we've seen with license-free bandwidth via Wi-Fi networking, we can share the airwaves without interfering with each other. Let new carriers emerge based on quality of service rather than spectrum owned. Cellphone coverage from huge cell towers will naturally migrate seamlessly into offices and even homes via Wi-Fi networking. No more dropped calls in the bathroom.
• End municipal exclusivity deals for cable companies. TV channels are like voice pipes, part of an era that is about to pass. A little competition for cable will help the transition to paying for shows instead of overpaying for little-watched networks. Competition brings de facto network neutrality and open access (if you don't like one service blocking apps, use another), thus one less set of artificial rules to be gamed.
• Encourage faster and faster data connections to our homes and phones. It should more than double every two years. To homes, five megabits today should be 10 megabits in 2011, 25 megabits in 2013 and 100 megabits in 2017. These data-connection speeds are technically doable today, with obsolete voice and video policy holding it back.
Technology doesn't wait around, so it's all going to happen anyway, but it will take longer under today's rules. A weak economy is not the time to stifle change.
Data is toxic to old communications and media pipes. Instead, data gains value as it hops around in the packets that make up the Internet structure. New services like Twitter don't need to file with the FCC.
And new features for apps like Google Voice are only limited by the imagination. Mother-in-law location alerts? Video messaging? Whatever. The FCC better not treat AT&T and Verizon like Citigroup, GM and the Post Office. Cellphone operators aren't too big to fail. Rather, the telecom sector is too important to be allowed to hold back the rest of us.
New Logitech mice operate wherever
Logitech has launched a new range of laser mice that can work on glass or shiny surfaces. The new mice use two lasers rather than one to work on a variety of previously unusable surfaces.
The first laser picks out imperfections in the surface of a tabletop while the second laser focuses on microscopic imperfections highlighted and uses those to direct the cursor.
The technique, dubbed dark field microscopy, allows mice to be used on almost any surface, including glass as long as it is more than 4mm thick.
"Laptops have gained popularity in the last several years because of the freedom they afford – people today want to be able to connect to their digital world anytime, anywhere. However, until now, no mouse has been able to match that flexibility," said Rory Dooley, Logitech’s senior vice president and general manager of the Control Devices business unit.
"Thanks to Logitech Darkfield, whether you’re checking the morning news from the granite counter top in your kitchen or at work manipulating a spreadsheet from your glass desk, you can be confident that your Logitech mouse will be up to the task."
The two models, a desktop Performance Mouse MX and the smaller travel Anywhere Mouse MX are priced at Us$99.99 and US$79.99 respectively.
I Reduce Traffic Jams
Alright, not completely true, but there is a new study that give this validity.
Those who know me know I have a bit of a "heavy foot" - specifically, my right one.
So the next time I cut you off in traffic, run a yellow light, or pass you in the emergency lane (ok, joking on that last one!) just remember it's for the common good :)
Jerks actually reduce the risk of traffic jams: http://physicscentral.com/buzz/blog/index.cfm?postid=3414795237807494042
Those who know me know I have a bit of a "heavy foot" - specifically, my right one.
So the next time I cut you off in traffic, run a yellow light, or pass you in the emergency lane (ok, joking on that last one!) just remember it's for the common good :)
Jerks actually reduce the risk of traffic jams: http://physicscentral.com/buzz/blog/index.cfm?postid=3414795237807494042
Mydoom Virus Variant to Wipe Your Hard Drive Friday
Several news sources are reporting that the tens of thousands of Microsoft Windows systems infected with the Mydoom worm and being used in an ongoing denial of service attack against US and S. Korean government Web sites will likely have their hard drives wiped of data come Friday. From The Washington Post's Security Fix blog, the malware is 'designed to download a payload from a set of Web servers. Included in that payload is a Trojan horse program that overwrites the data on the hard drive with a message that reads "memory of the independence day," followed by as many "u" characters as it takes to write over every sector of every physical drive attached to the compromised system.' ChannelNews Asia carries similar information.
7 Critical Secrets To Safe-Guarding Your Wireless Router
Manufacturers leave the configuration "open" so that the user can easily set up the router and get it up and running quickly. However, there is a risk if the router is not secure.
1) Change Admin password. Most wireless routers ship with a blank password. It is essential that this is changed or else a potential hacker could get into your router configuration and lock you out of your own hardware.
2) Change The Network Name (SSID). The default network name is usually made up of the name/model of your wireless router. This information gives a head start for a hacker and makes it easier for them to break into your network. Don't rename it to something like your surname or house name as this unnecessarily exposes personal information. Rename it to an alpha-numeric string - this can be up to 32 characters long.
3) Turn off SSID broadcasting. By default, a wireless router's SSID is broadcast so anyone in the vicinity of your wireless router can see that it. SSID broadcasting can be turned off thus making your wireless router virtually invisible.
4) Enabling Encryption. This is switched off by default. There is a choice of WEP, WPA and WPA2. Currently the latest encryption method is WPA2, so use this where possible. Both your wireless router and wireless PC adapter must be configured to use the same encryption.
5) Mac Address Control. All hardware has a unique MAC address associated with it, including your PC's adapter card. This MAC address can be added to access control list in the wireless router. Only devices added to the router's access control list are allowed to be connected.
6) Update router firmware. It is recommended that the latest router firmware is downloaded from the manufacturer's website and installed in the router. This will hopefully fix any bugs that have been found for your router and also help with any known security flaws in the router itself.
7) Backup settings. Finally, backup all router settings. If you reset the router back to its factory default settings for whatever reason, your configuration can later be easily and quickly restored back into the router.
Colin Receveur
SmartBox, LLC
www.SmartBoxllc.com
Jeez my computer died what do I do?
Computer problems are frustrating. Becoming frustrated during the troubleshooting process will only lead to more problems. So the important thing to do first is take a deep breath, think happy thoughts, and plan out your course of action. Have tools ready, restore disks and drivers. This will save you time and patience.
read more | digg story
read more | digg story
"Who Bought My Data?!"
Hundreds and hundreds of documents about government contracts,' were found on a hard drive purchased at a market in Ghana for the bargain basement price of $40, said Peter Klein, an associate professor with the University of British Columbia, who led an investigation into the global electronic waste business for the PBS show Frontline. The hard drive had belonged to US government contractor Northrop Grumman and in a made-for-TV ironic twist, 'some of the documents talked about how to recruit airport screeners and several of them even covered data security practices,' Klein said. 'Here were these contracts being awarded based on their ability to keep the data safe.
Windows 7 Licensing a "Disaster" For XP Shops
Enterprise licensing for Windows 7 could cause major headaches and add more cost to the Windows 7 migration effort, InfoWorld reports. Under the proposed license, businesses that purchase PCs with Windows 7 pre-installed within six months of the Oct. 23 launch date will be able to downgrade those systems to XP, and later upgrade back to Windows 7 when ready to migrate users.
PCs bought after April 22, 2010, however, can only be downgraded to Vista — no help for XP-based organizations, which would be wise to wait 12 to 18 months before adopting Windows 7, so that they can test hardware and software compatibility and ensure their vendors' Windows 7 support meets their needs. XP shops that chose not to install Vista will have to either rush their migration process or spend extra to enroll in Microsoft's Software Assurance program, which allows them to install any OS version — for about $90 per year per PC.
PCs bought after April 22, 2010, however, can only be downgraded to Vista — no help for XP-based organizations, which would be wise to wait 12 to 18 months before adopting Windows 7, so that they can test hardware and software compatibility and ensure their vendors' Windows 7 support meets their needs. XP shops that chose not to install Vista will have to either rush their migration process or spend extra to enroll in Microsoft's Software Assurance program, which allows them to install any OS version — for about $90 per year per PC.
Microsoft to Release Record Setting Number of Critical Security Updates
Microsoft today issued 10 security updates that patched a record 31 vulnerabilities in Windows, Internet Explorer, Excel, Word, Windows Search and other programs, including 18 bugs marked 'critical.' Of the 10 bulletins, six patched some part of Windows, while three patched an Office application or component, and one fixed a flaw in IE. The total bug count was the most patched by Microsoft in a single month since the company began regularly scheduled updates in 2003. The previous record of 26 vulnerabilities patched occurred in both August 2008 and August 2006.
'This is a very broad bunch,' said Wolfgang Kandek, CTO at Qualys, 'compared to last month, which was really all about PowerPoint. You've got to work everywhere, servers and workstations, and even Macs if you have them. It's not getting any better, the number of vulnerabilities [Microsoft discloses] continues to grow.'
'This is a very broad bunch,' said Wolfgang Kandek, CTO at Qualys, 'compared to last month, which was really all about PowerPoint. You've got to work everywhere, servers and workstations, and even Macs if you have them. It's not getting any better, the number of vulnerabilities [Microsoft discloses] continues to grow.'
Microsoft to Excel Users: Wiggle Your Mouse
I don't usualy post comical things on my blog, I try to keep it informative and helpful, but this is just too funny to pass up.
We've all heard of crazy "workarounds" as they're called - this one takes the cake.
This is a workaround for a data import function into Microsoft Excel. What is Microsoft's grand solution if it locks up while you're attempting this? Wiggle your mouse.
Read more at: http://support.microsoft.com/kb/168702
We've all heard of crazy "workarounds" as they're called - this one takes the cake.
This is a workaround for a data import function into Microsoft Excel. What is Microsoft's grand solution if it locks up while you're attempting this? Wiggle your mouse.
Method 2: Move Your Mouse Pointer
If you move your mouse pointer continuously while the data is being returned to Microsoft Excel, the query may not fail. Do not stop moving the mouse until all the data has been returned to Microsoft Excel.
NOTE: Depending on your query, it may take several minutes to return the results of your query to the worksheet.
Read more at: http://support.microsoft.com/kb/168702
Password Stealer Found on New Netbooks
An interesting development that Kaspersky Labs stumbled across.. They purchased a new M&A Companion Touch netbook in order to test a new anti-virus product targeted at the netbook segment, and discovered three pieces of malware on the factory-sealed netbook. A little sleuthing turned up the likely infection scenario — at the factory, someone was updating Intel drivers using a USB flash drive that was infected with a variant of the AutoRun worm.
"Installed along with the worm was a rootkit and a password stealer that harvests log-in credentials for online ... To ensure that a new PC is malware-free, [Kaspersky] recommended that before users connect the machine to the Internet, they install security software, update it by retrieving the latest definition file on another computer, and transferring that update to the new system, then running a full antivirus scan."
"Installed along with the worm was a rootkit and a password stealer that harvests log-in credentials for online ... To ensure that a new PC is malware-free, [Kaspersky] recommended that before users connect the machine to the Internet, they install security software, update it by retrieving the latest definition file on another computer, and transferring that update to the new system, then running a full antivirus scan."
Gartner tells businesses: forget about Vista
IT analyst firm Gartner has told businesses to skip Vista and prepare to roll out Windows 7.
Companies have traditionally been advised to wait until the first Service Pack of an operating system arrives before considering migration.
However, Gartner is urging organisations that aren't already midway through Vista deployments to give the much-maligned operating system a miss.
"Skip Vista and target Windows 7," Gartner analysts Michael Silver and Stephen Kleynhans advise in a research paper. "Preparing for Vista will require the same amount of effort as preparing for Windows 7, so at this point, targeting Windows 7 would add less than six months to the schedule and would result in a plan that is more politically palatable, better for users, and results in greater longevity."
Even businesses that are midway through planning a Vista migration are urged to consider scrapping the deployment. "Consider switching to Windows 7 if it would delay deployment by six months or less," the pair advise. "The further you are withyour Vista plans, the more sense it makes to continue." Companies who are in the midst of a deployment should carry on, the Gartner team says, although they should plan to move again to Windows 7 in "late 2010 or early 2011". The Gartner experts say all companies should move off Windows XP by the end of 2012 to avoid problems with application compatibility. Read more at http://www.pcpro.co.uk/news/252955/gartner-tells-businesses-forget-about-vista.html#
ARS TECHNICA: 2009 Flash Drive Roundup
From Ars: "When we last took an in-depth look at USB flash drives in 2005, the landscape was a bit different. A 2GB drive ran nearly $200, and speeds were quite a bit slower then. At the time, we noted that while the then-current crop of drives was pretty fast, they still were not close to saturating the bandwidth of USB2. To top it off, a good drive was still going to set you back $50 or $70—not exactly a cheap proposition. Since our first roundup, this picture has changed considerably, and it leads to a question: has the flash drive become an undifferentiated commodity, just like any other cheap plastic tsotschke that you might find at an office supply store checkout counter?
Consider the following factors:
- The majority of flash drives sold are either 4GB or 8GB, which is more than plenty of storage for most people.
- Most of the drives in this size range are under $20.
- Accessories (like neck straps, USB extension cables, spare caps, etc.) are no longer included.
Normally, twenty dollars is not something that most of us would think twice about, but don't most of us still want to know that we are getting our money's worth? To test this commodity theory, we selected a cornucopia of mostly 4GB and 8GB USB flash drives ranging from $9 to $30 dollars (average: $19.00)
Read more on Ars website (www.arstechnica.com) ..Microsoft's Life Cycle for Windows - The Death of 2000, and soon XP.
I've long recommended to my clients that they stay within Microsoft's life cycle with respect to their Windows operating systems. Most of them, even after explaining it, I suspect deep down they think it's a scheme to extort more money out of them to upgrade. Well, here's a perfect example to backup my claims.
This is why NO ONE should be running Windows 2000 or Millennium (ME) anymore (or earlier, i.e. 98, NT, 95, etc). The last sentence sums it up very nicely. Even with a current anti-virus subscription, you are NOT protected!
"Recently, the Conficker/Downadup worm infected several hundred machines and critical medical equipment in an undisclosed number of US hospitals. The attacks were not widespread; however, Marcus Sachs, director of the SANS Internet Storm Center, told CNET News that it raises the awareness of what we would do if there were millions of computers infected in hospitals or in critical infrastructure locations. It's not clear how the devices (including heart monitors, MRI machines and PCs) got infected. Infected computers were running Windows NT and Windows 2000 in a local area network (LAN) that wasn't supposed to be Internet accessible, but the LAN was connected to one with direct Internet access. A patch was released by Microsoft last October by November that fixes the problem, but the computers infected were reportedly too old to be patched."
This is why NO ONE should be running Windows 2000 or Millennium (ME) anymore (or earlier, i.e. 98, NT, 95, etc). The last sentence sums it up very nicely. Even with a current anti-virus subscription, you are NOT protected!
"Recently, the Conficker/Downadup worm infected several hundred machines and critical medical equipment in an undisclosed number of US hospitals. The attacks were not widespread; however, Marcus Sachs, director of the SANS Internet Storm Center, told CNET News that it raises the awareness of what we would do if there were millions of computers infected in hospitals or in critical infrastructure locations. It's not clear how the devices (including heart monitors, MRI machines and PCs) got infected. Infected computers were running Windows NT and Windows 2000 in a local area network (LAN) that wasn't supposed to be Internet accessible, but the LAN was connected to one with direct Internet access. A patch was released by Microsoft last October by November that fixes the problem, but the computers infected were reportedly too old to be patched."
Researchers Find Massive Botnet On Nearly 2 Million Infected Consumer, Business, Government PCs
More than 70 government-owned domains hit, and nearly half of the overall infections are in the U.S.
Researchers have discovered a major botnet operating out of the Ukraine that has infected 1.9 million machines, including large corporate and government PCs mainly in the U.S.
The botnet, which appears to be larger than the infamous Storm botnet was in its heyday, has infected machines from some 77 government-owned domains -- 51 of which are U.S. government ones, according to Ophir Shalltin, marketing director of Finjan, which recently found the botnet. Shalltin says the botnet is controlled by six individuals and is hosted in Ukraine.
Aside from its massive size and scope, what is also striking about the botnet is what its malware can do to an infected machine. The malware lets an attacker read the victim's email, communicate via HTTP in the botnet, inject code into other processes, visit Websites without the user knowing, and register as a background service on the infected machine, for instance. The bots communicate with their command and control systems via HTTP.
Botnet expert Joe Stewart says it appears to be similar to other downloader-type botnets. "It looks a lot like other downloader bots out there," says Stewart, director of malware research for SecureWorks. "It has a system for installing other malware and getting paid for it. The first stage is to get the bot piece onto the machine, and then they get paid to install other malware."
Finjan says victims are infected when visiting legitimate Websites containing a Trojan that the company says is detected by only four of 39 anti-malware tools, according to a VirusTotal report run by Finjan researchers.
"We don't have our hands on the actual [stolen] data, but we can tell a lot of what they [may be] doing with it by the malware," Shalltin says. "They can use it for spam, [stealing data], and almost almost anything."
Around 45 percent of the bots are in the U.S., and the machines are Windows XP. Nearly 80 percent run Internet Explorer; 15 percent, Firefox; 3 percent, Opera; and 1 percent Safari. Finjan says the bots were found in banks and large corporations, as well as consumer machines.
Shalltin says it appears that the botnet operators may be buying and selling bots or portions of their botnet based on a communique Finjan discovered on an underground black-hat hacker forum in Russia.
Conficker Launches April 1 (and no this isn't a joke)
It's lurking in millions of PCs around the world. It's incredibly sophisticated and resilient, with built-in p2p and digital code-signing technology. It revels in killing security software. On April 1, the Conficker worm will activate.
The scariest thing about the Conficker worm is that literally millions of infected Windows PCs could be linked together to do its bidding. The second scariest thing is that no one really knows what its creator is going to do with this virtual army on April 1, when it's scheduled to contact a server for instructions. It's so bad, Microsoft has a running $250,000 bounty for the author, dead or alive. (Well, they probably want him alive, but they hate his guts.)
The New York Times' John Markoff rounded up some of the more ingeniously evil possibilities in a compelling article, the most sinister being a "Dark Google," postulated by University of California at San Diego researcher Stefan Savage, that would let bad people scour zombie machines all around the world for data to sell to other bad people.
But let's back up a bit. Conficker—whose weird name is a combination of "configuration" and a slightly more polite word for f***er, according to Urban Dictionary—actually began life as a lowly, "not very successful" worm in November, says Vincent Weafer, VP at Symantec Security Response. Weafer told us it exploited a Microsoft remote server vulnerability that had already been announced and patched the previous month, so the only systems that were vulnerable were the ones that weren't up to date.
The B release, pushed in December, on the other hand, was "wildly successful," says Weafer, infecting millions of unpatched computers because it's an aggressive little bastard—the first worm in years on a scale like Blaster. It has built-in p2p capabilities, and brute forces its way into open shared folders or printers, so it can crawl an office network quickly. It also piggybacks onto USB flash and hard drives. On top of all that, it's designed to be incredibly resilient, killing security software, disabling Windows Update, and digging down deep.
The C release came out this past month. It doesn't go after new machines—it's actually a payload for computers already infected with B. It transformed Conficker from a sneezing pandemic into a seriously nasty plague. With C, its p2p powers are extended further, with digital code-signing, so it only accepts trusted code updates from itself. That means security experts can't simply inject code to neutralize it. The patch also made Conficker better at killing security software. And it expanded the scope of the domains it tries to contact for instructions from 250 to 50,000, completely neutralizing security experts' previous tactic of seizing the domains. There's effectively no way to the cut the head off of this demon snake. The stage is set: On April 1, Conficker will reach out for the millions-strong zombienet's next set of instructions.
So what will happen? Well, no one knows for sure. Conficker's creator can do whatever he wants with his army. Launch massive denial-of-service attacks, setup the "Dark Google" syndicate, target millions of new machines, or generate a tidal wave of spam that'll crash against servers all over the world.
Most likely though, Weafer told us, Conficker's creator is motivated by money—they'll rent it out. And if Conficker's used as a massive doomsday tool, they'll "quickly lose the ability to make money" with it. A low key operation harnessing the power of computers that are mainly located in developing nations may not have a big impact, though it would certainly set a terrible precedent: Whatever Conficker's results, they will lead others to develop this idea in frightening new directions.
Conficker's innovative approach that utilizes p2p, code-signing and a distributed domain setup will very possibly serve as inspiration to other malware writers, who Weafer said "you can bet" are watching Conficker's success very closely, just as Conficker's creators have clearly learned from past malware. It's like evil open source.
That doesn't mean April 1 will be a "digital Pearl Harbor." If your machine is patched and up to date, the Microsoft Report's Ed Bott tells us, you'll probably be totally fine. And yes, you can get rid of it if you happen to be infected. There is an outside chance Conficker could turn into a massive parallel computer that borders on self-aware, come April 1, but more than likely, the day will come and go without you noticing anything weird, just some extra spam in your box for some V@ltr3xxx.Conficker Worm Gets an Evil Twin
The criminals behind the widespread Conficker worm have released a new version of the malware that could signal a major shift in the way the worm operates.
The new variant, dubbed Conficker B++, was spotted three days ago by SRI International researchers, who published details of the new code on Thursday. To the untrained eye, the new variant looks almost identical to the previous version of the worm, Conficker B. But the B++ variant uses new techniques to download software, giving its creators more flexibility in what they can do with infected machines.
Conficker-infected machines could be used for nasty stuff -- sending spam, logging keystrokes, or launching denial of service (DoS) attacks, but an ad hoc group calling itself the Conficker Cabal has largely prevented this from happening. They've kept Conficker under control by cracking the algorithm the software uses to find one of thousands of rendezvous points on the Internet where it can look for new code. These rendezvous points use unique domain names, such as pwulrrog.org, that the Conficker Cabal has worked hard to register and keep out of the hands of the criminals.
The new B++ variant uses the same algorithm to look for rendezvous points, but it also gives the creators two new techniques that skip them altogether. That means that the Cabal's most successful technique could be bypassed.
Conficker underwent a major rewrite in December, when the B variant was released. But this latest B++ version includes more subtle changes, according to Phil Porras, a program director with SRI. "This is a more surgical set of changes that they've made," he said.
To put things in perspective: There were 297 subroutines in Conficker B; 39 new routines were added in B++ and three existing subroutines were modified, SRI wrote in a report on the new variant. B++ suggests "the malware authors may be seeking new ways to obviate the need for Internet rendezvous points altogether," the report states.
Porras could not say how long Conficker B++ has been in circulation, but it first appeared on Feb. 6, according to a researcher using the pseudonym Jart Armin, who works on the Hostexploit.com Web site, which has tracked Conficker.
Though he does not know whether B++ was created in response to the Cabal's work, "it does make the botnet more robust and it does mitigate some of the Cabal's work," Support Intelligence CEO Rick Wesson said in an e-mail interview.
Also known as Downadup, Conficker spreads using a variety of techniques. It exploits a dangerous Windows bug to attack computers on a local area network, and it can also spread via USB devices such as cameras or storage devices. All variants of Conficker have now infected about 10.5 million computers, according to SRI.
Microsoft Slaps $250K Bounty On Conficker Worm
The spreading Conficker/Downadup worm is now viewed as such a significant threat that it's inspired the formation of a posse to stop it, with Microsoft leading the charge by offering a $250,000 reward to bring the Conficker malware bad guys to justice. The money will be paid for 'information that results in the arrest and conviction of those responsible for illegally launching the Conficker malicious code on the Internet,' Microsoft said today in a statement, adding it is fostering a partnership with Internet registries and DNA providers such as ICANN, ORG, and NeuStar as well as security vendors Symantec and Arbor Networks, among others, to stop the Conficker worm once and for all. Conficker, also called Downadup, is estimated to have infected at least 10 million PCs. It has been slowly but surely spreading since November. Its main trick is to disable anti-malware protection and block access to anti-malware vendors' Web sites.
The Microsoft Windows 7 Upgrade Program
With Windows 7 set for release in Dec. 09, Microsoft is getting ready with their free upgrade program, which allows Vista users to switch to Windows 7 when it arrives. The folks at TechARP have consistently scored accurate scoops on Microsoft software releases. They have now revealed Microsoft's upgrade plans, schedules and even screenshots of the upgrade process.
"Conficker" Infects 9 Million Over the Weekend
The Conficker malware outbreak has continued to spread among corporate PCs in what appears to be the biggest IT security breach in the past seven years.
Initially it was reported Conficker, or Downadup, focused on machines that weren't patched with a Microsoft emergency fix released last October (MS008-067).
However since then, the bug has evolved and is now able to spread to patched computers through portable USB drives.
Once in the machine, the worm can browse through the network the computer is connected to and copy itself to other machines, according to the article. This means users do not have to be at their computers or even logged on for the bug to spread.
Infected machines can potentially reveal users' personal and financial information, though it is unclear if that is the objective of the cybercriminals behind the attack. With the presidential inauguration scheduled for today, it's possible the cybercriminals may act then, since they traditionally like to coincide attacks with large events.
Initially it was reported Conficker, or Downadup, focused on machines that weren't patched with a Microsoft emergency fix released last October (MS008-067).
However since then, the bug has evolved and is now able to spread to patched computers through portable USB drives.
Once in the machine, the worm can browse through the network the computer is connected to and copy itself to other machines, according to the article. This means users do not have to be at their computers or even logged on for the bug to spread.
Infected machines can potentially reveal users' personal and financial information, though it is unclear if that is the objective of the cybercriminals behind the attack. With the presidential inauguration scheduled for today, it's possible the cybercriminals may act then, since they traditionally like to coincide attacks with large events.
The Internet GateKeepers at Google
"With control of 63% of the world's Internet searches, as well as ownership of YouTube, the NY Times reports that Google is the most powerful and protean of the Internet gatekeepers, exerting enormous influence over who can find an audience on the Web around the world. Deciding what controversial material does and doesn't appear on the local search engines Google maintains in many countries — as well as on Google.com, YouTube, Blogger, Picasa, and Orkut — falls on the shoulders of Nicole Wong and her colleagues, who have arguably been given more influence over online expression than anyone else on the planet. Some find Google's gatekeeper role worrisome: 'If your whole game is to increase market share,' says Lawrence Lessig, 'it's hard to do good, and to gather data in ways that don't raise privacy concerns or that might help repressive governments to block controversial content.'"
Which Web Browser is King?
There's really only one sanity test for a browser: whether it runs fast for you. A slow-loading, incompatible browser is one thing, but most modern browsers work fine for both Ford.com and Fark.com. The real issue is whether a browser loads fast for the sites you frequently visit.
It's a highly debatable topic, one that tends to be subjective and fraught with inconsistencies. For example, latency on the Internet can dramatically affect browser speed. One day, Google Chrome can load IGN.com faster than butter on a banana, the next day (say, when a new Gears of War 2 review posts), latency can slow the site to a crawl, and Chrome seems like a dud. That's why, when you see speed tests for browser that claim "Chrome loads faster" it's important to ask a few questions: loaded when, over what broadband speed, with what other apps running, on what machine?
Speed, of course, isn't everything. We ran into an interesting compatibility glitch or two completing some of our tests. If a browser can't finish a particular benchmark, it doesn't get a score.
What does it mean, ultimately? For the average user, it may not mean much. But for those of us who spend vast amounts of time on the Internet, for work and play, browser performance is a big issue. Waiting for sites to load is no fun when you're trying to get work done.
Let's dive into the testing methodology. Continued...
It's a highly debatable topic, one that tends to be subjective and fraught with inconsistencies. For example, latency on the Internet can dramatically affect browser speed. One day, Google Chrome can load IGN.com faster than butter on a banana, the next day (say, when a new Gears of War 2 review posts), latency can slow the site to a crawl, and Chrome seems like a dud. That's why, when you see speed tests for browser that claim "Chrome loads faster" it's important to ask a few questions: loaded when, over what broadband speed, with what other apps running, on what machine?
Speed, of course, isn't everything. We ran into an interesting compatibility glitch or two completing some of our tests. If a browser can't finish a particular benchmark, it doesn't get a score.
What does it mean, ultimately? For the average user, it may not mean much. But for those of us who spend vast amounts of time on the Internet, for work and play, browser performance is a big issue. Waiting for sites to load is no fun when you're trying to get work done.
Let's dive into the testing methodology. Continued...
Microsoft Takes 7 Years to Release Security Patch
Back in March 2001, a hacker named Josh Buchbinder (a.k.a Sir Dystic) published code showing how an attack on a flaw in Microsoft's SMB (Server Message Block) service worked. Or maybe the flaw was first disclosed at Defcon 2000, by Veracode Chief Scientist Christien Rioux (a.k.a. Dildog). It was so long ago, memory is dim. Either way, it has taken Microsoft an unusually long time to fix. Now, a mere seven and a half years later, Microsoft has released a patch. 'I've been holding my breath since 2001 for this patch,' said Shavlik Technologies CTO Eric Schultze, in an e-mailed statement. Buchbinder's attack, called a SMB relay attack, 'showed how easy it was to take control of a remote machine without knowing the password,' he said.
Windows 7 Benchmarks Show Little Improvement On Vista
InfoWorld's Randall Kennedy examines Windows 7 from the kernel up, subjecting the 'pre-beta' to a battery of benchmarks to find any signs that the OS will be faster, more responsive, and less resource-intensive than the bloated Vista, as Microsoft suggests. Identical thread counts at the kernel level suggest to Kennedy that Windows 7 is a "minor point-type of release, as opposed to a major update or rewrite." Memory footprint for the kernel proved eerily similar to that of Vista as well.
"In fact, as I worked my way through the process lists of the two operating systems, I was struck by the extent of the similarities," Kennedy writes, before discussing the results of a nine-way workload test scenario he performed on Windows 7 — the same scenario that showed Vista was 40 percent slower than Windows XP.
"In a nutshell, Windows 7 M3 is a virtual twin of Vista when it comes to performance," Kennedy concludes. "In other words, Microsoft's follow-up to its most unpopular OS release since Windows Me threatens to deliver zero measurable performance benefits while introducing new and potentially crippling compatibility issues."
"In fact, as I worked my way through the process lists of the two operating systems, I was struck by the extent of the similarities," Kennedy writes, before discussing the results of a nine-way workload test scenario he performed on Windows 7 — the same scenario that showed Vista was 40 percent slower than Windows XP.
"In a nutshell, Windows 7 M3 is a virtual twin of Vista when it comes to performance," Kennedy concludes. "In other words, Microsoft's follow-up to its most unpopular OS release since Windows Me threatens to deliver zero measurable performance benefits while introducing new and potentially crippling compatibility issues."
Subscribe to:
Posts (Atom)
