IT Trenches:

March, 2009

Mar 31 2009   3:32PM GMT

Simple Conficker Scanner tool released - find the infected machines



Posted by: Troy Tate
honeynet, diagnostic tools, Conficker, ms08-067, antivirus, patches, anti-virus, detection, scanning, vulnerability scanning, vulnerability

A Simple Conficker Scanner (SCS) tool has been released by members of the Honeynet Project. This tool can be run under linux or Windows. It runs a specially crafted RPC query against a host or range of IP addresses. The tool will tell if systems are clean or potentially infected. I am running this tool against hosts on my network and I found a Windows 2000 server apparently infected by Conficker. I am in the process of clean-up on that host. It looks like a couple of things contributed to the infection on this computer:

1. Out of date anti-virus. The antivirus signatures had not been updated since January 2008.

2. Microsoft patches not applied.

Folks, the advice about maintaining up-to-date AV and applying patches is good advice. Heed the warnings and save yourself some troubles of clean-up. I will be having a discussion with my operations team about this situation and make it clear that we should have been prepared for this and this situation should not have arisen.

I am also following the advice from McAfee on Combating the Conficker worm

For more details on how the Conficker worm actually works, follow the links in my blog

The Conficker Analysis - are you ready for April 1?

Thanks for reading. Let’s continue to be good network citizens.

Mar 27 2009   12:52PM GMT

The Conficker Analysis - are you ready for April 1?



Posted by: Troy Tate
Conficker, worm, updates, Microsoft updates, Microsoft patch, patch, patching, patches, asset management

There is a feeling in the infosec community that Conficker may change its behavior April 1 and wreak havoc. Headlines have included:

ComputerWorld: Conficker’s next move a mystery to researchers

Computer Reseller News: Conficker Worm to Strike April 1

USA Today: PC security forces face April 1 showdown with Conficker worm

Here’s a great analysis of the Conficker variants and some details to show what to be concerned about.

Take a look at this guidance from Microsoft on Conficker.A and Conficker.B. You need to get the MS08-067 (KB958644) patch rolled out as soon as you can to your machines.

Good luck and if there is a big outbreak on your network, break the internet connection or shutdown the machines until you get them checked & updated. Don’t be afraid to shut things down to get them cleaned up. Then… once you do get things cleaned up and can estimate the time it took… figure out how much you could have saved and look at purchasing a good asset management system like Windows Systems Center Configuration Manager to push out patches and fixes to your devices.

Thanks for reading & let’s continue to be good network citizens.


Mar 26 2009   7:38PM GMT

Do You Manage Sharepoint and want training? - Free Microsoft How-to Videos



Posted by: Troy Tate
SharePoint, technet, training, videos, how-to, Microsoft Sharepoint, Microsoft Powershell, Powershell, scripting, podcast, free training, training resources

It’s always nice to come across free training, especially in the economic times most companies are experiencing today. It is also good to be able to do some self-education to better prepare yourself for whatever may lie ahead in your career.

Microsoft offers lots of training materials. I previously wrote about a couple of them

Did you see this? - FREE TRAINING: Technet Virtual Lab: Managing Bandwidth Using Windows QOS

Did you see this? - 10 Cool Powershell scripts virtual lab

I just came across another Microsoft training resource that covers Microsoft SharePoint. Take a look at the SharePoint Products and Technologies “How Do I?” Videos. Maybe you can find the solution to that problem that has been nagging you or your users or do something nifty and cool and impress the users! You can download the videos in lots of different formats including WMV, iPod, and MP4.

Thanks for reading & let’s continue to be good network citizens.


Mar 23 2009   3:57PM GMT

Need help? Ask questions - help someone - read my blog & win one of 3 XBox 360’s



Posted by: Troy Tate
Security, protocol analysis, contest, xbox, social engineering, social networking, network throughput, network capacity, analysis tools, tools, Cisco

Looking for some help on some troublesome IT isssues? Post your question on IT Knowledge Exchange. Maybe take some time to read through some of the questions on ITKE. Provide an answer or even improve answers already given or give some discussion feedback. By doing these things with other IT peers, you could just win one of three XBox 360’s to be given away in April.

While you are her on ITKE, why not take some time, read through a few of my blog postings, maybe there is something there that would be of value to you or someone else you know. Send your fellow IT peers to ITKE. Make this the best free online support community and a one-stop shop for getting the support you need for those IT issues we each face every day.

Some of my blogs that will hopefully be of interest to you include:

What did I just do with my contacts list? - Social Engineering/Networking & contact list scraping

Network speed & capacity are NOT the same

Financial crisis due to poor risk understanding & management - IT security next?

Nifty tools for tracking down that “interesting” network traffic

PROTOCOL analysis vs protocol analysis (with a small p)

Good luck with the contest! Stay tuned for more and thanks for reading. Let’s continue to be good network citizens together.


Mar 20 2009   2:55PM GMT

What did I just do with my contacts list? - Social Engineering/Networking & contact list scraping



Posted by: Troy Tate
FUD, social networking, contact lists, registration, sharing

A recent article in the Windows Secrets newsletter titled Viral Inviters Want Your E-mail Contact List raised some fear, uncertainty and doubt (FUD) in my mind. Sometimes we use FUD as a term of derision, but in this case it might be warranted suspicion. How many times have you registered on a social networking website and get prompted to contact all of your contacts to join you there? Sounds simple and painless, right? Maybe not painless… simple it is for sure. Just be wary of what you click on and accept on these social networking websites. Warn your contacts about the same and create some type of notice you can send back to them when you receive an invitation that came through their interaction with such a social networking website.

Thanks for reading & let’s continue to be good network citizens.


Mar 13 2009   6:25PM GMT

Friday fun - keyboards for blondes, Polacks, Aggies… hmmm… and me?



Posted by: Troy Tate
humor, keyboard, joke, equipment, product

Please don’t take this wrong but I think this is a very funny product. It is directed towards blondes, hence the pink color, but pick your favorite “intellectually challenged” individual (e.g. Aggie if you are a Texan like me) and it could be the best thing to get them for their birthday, anniversary or other gift giving occasion. Maybe the American Blonde Association of America will release this for use by other populations.

It’s the Keyboard For Blondes.

Some of the function keys include:

NO! - formerly known as ESC

WARNING! Size XXL letters - CAPS lock

Smart Blonde Button - Shift

THE BIG ONE: “I need my space” key - spacebar

OOPS! - Backspace

Way Up - Page Up

Way Down - Page Down

Hope this gets you laughing and maybe enjoying your work more thinking about creative key renaming.

Have a great Friday and thanks for reading!


Mar 13 2009   5:38PM GMT

Who hires IT staff anyways? Was it the US CIO or some HR crew?



Posted by: Troy Tate
CTO, HR, human resources, hiring, corruption, bribery, interview, certification, CSO, CISSP, CISA

Recently my fellow ITKE blogger Denny posted a rant against how IT people act in public. I know that his posting does not always apply just to IT folks. A news announcement today makes me wonder about the actions of some IT people and the way they get hired.

Per Network World on Thursday, 3/12/09:

According to a report in the Washington Post, Cisco CCNA Yusuf Acar who is currently employed as the Chief Security Officer (CSO) and/or Information Systems Security Officer (ISSO) of the Government of the District of Columbia, has been busted by the FBI in a federal bribery sting. FBI agents found $70,000 in Acar’s Northwest D.C. home when they arrested him this morning.

The question Brad Reese raises and I think should be considered in this forum is “Who is hiring these people?” Yusuf had no information security certifications or credentials (e.g. CISSP or CISA) to support his position as CSO. Continued »


Mar 10 2009   8:43PM GMT

Did you see this? - Microsoft Team Blogs - BlogMS



Posted by: Troy Tate
blog, Microsoft, Microsoft support, Microsoft knowledgebase

BlogMS consolidates a large number of highly relevant and up-to-date information sources across the Microsoft product and online services portfolio.  You can expect to find important Microsoft announcements, news, product releases, service packs, updates, and important support issues.

All blogs are grouped into logical categories, so you can quickly skim the entire document and find the most relevant information which is important to you.

You can find the February posting here:

http://blogs.technet.com/blogms/archive/2009/03/02/blogms-monthly-articles-published-in-february-2009.aspx

Monthly Report - 214 Microsoft Team blogs searched, 876 new articles found in 152 blogs between the 1st February 2009 and 28th February 2009.

Get some good scoop at BlogMS!

Thanks for reading & let’s continue to be good network citizens.


Mar 10 2009   4:47PM GMT

Saving Money & Stopping spam - change domain names



Posted by: Troy Tate
spam, email, domains, cost savings, cost reduction, WAN, internet, planning, operations

Are you getting lots of SPAM? Is your organization’s internet link being saturated due to tons of inbound spam and maybe outbound non-delivery notices for invalid addresses? About 3 years ago, ours was too. Continued »


Mar 6 2009   4:45PM GMT

Network speed & capacity are NOT the same



Posted by: Troy Tate
capacity, throughput, network speed, bandwidth, network band

There is often a misunderstanding of what network speed is versus capacity. The speed of data transfer is not just a function of the capacity (bandwidth) of the link, but of the distance between the endpoints. To find distances: Go to http://www.infoplease.com/atlas/calculate-distance.html to get distances between locations.

Considerations about the impact of latency and network throughput:
Networks do not transfer data in a continuous stream, as many people think, but in small packets. The server sends a packet to your computer, which sends an acknowledgement back (TCP/IP protocol). Upon receipt of the acknowledgement the server sends the next packet. This is called handshaking, it’s a little game of ping-pong.

The speed of light is 299792 kilometers per second. The maximum number of ping-pongs per second is therefore 299792 divided by twice the distance between you and the server. If the server is 1000 kilometers away that’s 149 ping-pongs per second. Every ping-pong is 1 packet, so if the packet size is 1 bit the server can only send you 149 bits per second. The speed of the network is immaterial, even a gigabit network cannot break the speed of light. The server is not sending data while waiting for the acknowledgement, waiting means less throughput, so the speed is reduced because of the distance. The further away,
the lower the speed.

Here’s some information that I came across but do not know the original source that will also help explain this situation.

Would you say that a Boeing 747 is three times “faster” than a Boeing 737? Of course not. They both cruise at around 500 miles per hour. The difference is that the 747 carries 500 passengers where as the 737 only carries 150. The Boeing 747 is three times bigger than the Boeing 737, not faster.

Now, if you wanted to go from New York to London, the Boeing 747 is not going to get you there three times faster. It will take just as long as the 737.

In fact, if you were really in a hurry to get to London quickly, you’d take Concorde, which cruises around 1350 miles per hour. It only seats 100 passengers though, so it’s actually the smallest of the three. Size and speed are not the same thing.

NOTE: In the internet world, there is no such thing as a Concorde. Data speed is limited to the speed of light. The speed of light in a vacuum is ~300,000 km/sec. – p.s. The Concorde jet service ceased operations in 2003  http://en.wikipedia.org/wiki/Concorde)

On the other hand, If you had to transport 1500 people and you only had one plane to do it, the 747 could do it in three trips where the 737 would take ten, so you might say the Boeing 747 can transport large numbers of people three times faster than a Boeing 737, but you would never say that a Boeing 747 is three times faster than a Boeing 737.

That’s the problem with communications devices today. Manufacturers say “speed” when they mean “capacity”. The other problem is that as far as the end-user is concerned, the thing they want to do is transfer large files quicker. It may seem to make sense that a high-capacity slow link might be the best thing for the job. What the end-user doesn’t see is that in order to manage that file transfer, their computer is sending dozens of little control messages back and forth. The thing that makes computer communication different from television is interactivity, and interactivity depends on all those little back-and-forth messages.

Thanks for reading and let’s continue to be good network citizens.