FBI_IRS.PDF 245K   View   Download

As you can see the email includes an attachment to be clicked, a PDF in this case.  This email is definitely a scam. I tested the PDF on a test system and it appears to be clean.  However you can see the text of this PDF below and see that it most definitely is a scam:

I thought it was a nice touch having the CC include the Supreme Court of the United States.

No matter what do no send an email or call the number in the announcement. It’s definitely a scam!!  For one this is not how government agencies communicate!!!  If you find any letters like this you are unsure of its best to find someone who can make the determination for you!

The fix for this is simple: The scroll lock key has been pushed on the keyboard. Hit the scroll lock key again and your arrows will work normally. If that doesn’t fix it I would check to make sure you don’t have a macro that is causing issues.

Starting a new business can be expensive. If this is your first business there will be an urge to spend money everywhere. It’s only natural because you’ve heard many times “it takes money to earn money”. Well I’m here to say that doesn’t mean you keep spending for no reason, especially when starting out. This is time when you need to keep on a shoestring budget.

It is far more wise and economic to start your business “on the cheap”. If the business can be started from your home that is a great way to save money. If not maybe someone you know has an office or retail space where they are willing to give you some space. Even if you pay rent to that person, it will likely be cheaper than leasing a space of your own.

Some other possible ways to save money up front:

• Don’t hire employees until you have enough work for them to keep busy! Until that time you can hire temps or other contractor types.
• Don’t over-buy office and other supplies! The urge will be there to get fully stocked. But remember every dollar you spend on supplies takes away from money you can spend elsewhere!
• Don’t over-spend on marketing. Targeted marketing will get a better return on investment than placing ads in every medium possible. Look at what your competitors are doing and start from there.
• Give out business cards! Business cards are cheap and they work. Give them out to everyone.
• Pass costs on to your customers. If you are just starting to get customers this is important. The urge will be there to eat a lot of costs to get/retain customers. Unfortunately this will also set a false expectation and may cost you a lot of money later on when you are stuck under-priced.
• Which leads to my final tip: DON”T UNDER-PRICE!! Setting a price for your goods or services is always hard. Do some research and see what your competitors are charging. If you believe your product is of superior quality then you can charge above the average rate. If you feel you have a competitive advantage and can provide cheaper prices then go below the average.

There are other ways to bootstrap your finances when starting a small business. The main key however is to make sure you only spend money when necessary.

Today I had a user posting budget periods in MS Forecaster 7. While doing that the computer had locked up and he had to reboot. After rebooting nobody could get write access because the following message came up:

The system is currently locked for maintenance. Contact the Microsoft Forecaster Administrator for further information.

I found some references to this in MS KB962792 and a few other articles, but nothing that actually helped. The actual fix to the issue was easy:

• Go into Forecaster client (not the web interface) as an administrator.
• Click OK to the Maintenance message.
• Go to “Tools” > “Recovery”
• You will get a nasty message saying you better mean to do this or it may cause inconsistencies. Click “Yes”.
• Click to re-index.
• Wait and hope it fixed the problem.

After doing this users were once again able to log into forecaster.

MD5 and SHA-1 have been the de facto hash methods available where I normally get files (MD5 shouldn’t be used anymore, but that’s another discussion). CRC32 is another one you may see.

If you use Microsoft Windows operating systems there is no build-in way to verify the hash of a downloaded file. I use a utility called HashCalc to perform this simple function. Here is the description off the HashCalc website:

A fast and easy-to-use calculator that allows to compute message digests, checksums and HMACs for files, as well as for text and hex strings. It offers a choice of 13 of the most popular hash and checksum algorithms for calculations.

Since it supports MD5 and SHA1 it covers 95% of what I need. For the few places that use other hash algorithms this program has still worked for me.

Use of the program is simple enough. Here are the steps:

1. Choose your data file by browsing to it.
2. Place a check in front of the algorithm to be used.
3. Click Calculate.
4. The output will be shown.

A few things to remember when using HashCalc:

• Don’t choose all possible algorithms. This will work, but may lock up your computer! Performing hash checks is very CPU intensive!
• While Windows XP is the last supported OS on their website. I can confirm the program works on Win7 64-bit.
• I have a colleague who uses HashTab. He says this is a great way to add functionality to Windows Explorer. I have not verified that however.

It may seem unnecessary to do this for network gear such as Cisco and Juniper devices (because you can check the hash right on the device). However, you may be in a situation where you download the file and then bring it to a client site with a thumb drive. It would sure be nice to know before you leave the file is good.

1. FTP is dead, stop using it!!! SCP, SFTP or other similar protocols should be used for transferring files! If your network devices are only setup for FTP or TFTP then get them configured correctly!! (The same goes for telnet, start using SSH!)
2. Its command line driven. This makes it quick/easy to use and script with.

That said I would recommend downloading and installing the Windows installer version of PuTTY from the download page. This will insure you have all of the binaries and help file available in your start menu, this is not required for operation however. The PuTTY installer does not update the path environment so PSCP can be run from anywhere.  To use PSCP from anywhere in the command line you will either need to use the full path for the executable every time or add the correct path statement.

Here are the steps for adding the path with Win7 (pretty much the same for other versions of Windows):

1. Go to the Start Menu and right-click on computer.
2. Choose Properties.
3. Click “Advanced System Settings”
4. Click on the “Environmental Variables” button.
5. In the “System Variables” section double-click on “Path”.
6. Go to the end of the “Variable Value” blank and semi-colon and the path to where the PuTTY binaries are located. Here is the path statement I added for my 64-bit Win7 machine:
   ;C:\Program Files (x86)\PuTTY
   For a 32-bit Windows OS it would be:
   ;C:\Program Files\PuTTY
7. Click OK out of all these screens and reboot.

You will now be able to use any of the PuTTY binaries (including PSCP) from the command line without using the full path.

Using PSCP is pretty easy. Just type PSCP without any options to see the usage.

Here is a sample upload via PSCP:

pscp test.file root@testhost:/tmp/

Here is a sample download via PSCP:

pscp root@testhost:/tmp/test.file .

If you’re not comfortable using the command line in Windows for file transfer then I would recommend WinSCP. But then if your working in network devices or Linux I would image you are OK with the command line.

Adobe Reader should NOT be updating every day. If the reader is updating every day there is a problem. Looking at Adobe Readers downloads it can be seen that an update comes out about every couple of months or so.

The first suspect I would look at is malware/virus. TrendLabs released a warning last April about a Trojan (TROJ_FAYKDOBE.A) that looks identical to the Adobe Updater. The updater would then download other malicious files. I expect this type of attack to happen more often. It is imperative that you keep your anti-virus software up to date and do regular full scans of your computer.

If you are having a problem with Adobe Reader updating every day I would immediately update your anti-virus software and do a full scan. Trend Micro rates this type of attack as a high damage potential due to it being able to download anything to your computer.

If your computer is clean from virus/malware it is likely that your Adobe Reader has technical issues. One option would be to uninstall Adobe Reader, then install the latest version back on. The current version of Adobe Reader (Adobe Reader X at the time of this post) can always be found here.

Another option it to use an alternate PDF reader. I like Foxit as a PDF reader. It seems to work much quicker than Adobe and has fewer known security vulnerabilities.

\HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions

If you’re not sure how to export and import registry keys this article has some easy to follow steps specific to PuTTY. It’s a fairly easy process, and I figure if your smart enough to use PuTTY you should be able to import/export registry keys without breaking your computer (but still, play with the Registry at your own risk!).

Now to take it another step you could have the sessions exported every day via the following PowerShell command:

REG EXPORT HKCU\Software\SimonTatham\PuTTY\Sessions c:\putty.reg

Simply put that into a  PS script and change the destination to where ya want (I have it set to c:\putty.reg). You could then use Task Scheduler to back it up once a day/week/whatever.

One final note: Earlier I posted about notepad++, which could be used to create the PS script and view/modify the reg file.

Network gear config files need to be done with an ASCII editor. Programs such as MS Word can throw in extra characters if you’re not careful. Actually I do all config files with Notepad++, whether it’s for a Cisco Router or a Windows application. (**In UNIX/Linux i use VIM, thats a completely different post).

Notepad++ supports multiple tabs. If you are working on a lot of files this  feature is essential! You can even perform searches on multiple tabs. This is helpful when reviewing logs. You can also use plugins to compare different files (helpful to see what changed on a router config).

This is by far the best scripting tool I’ve used. There is built-in support for almost any scripting language you can think of. I use it mostly for PERL, HTML, and PHP. But recently I decided to learn how to script with PowerShell and it has built-in support for that. Here is an example of a PowerShell script I’m working on right now:

Notice how nice this is to work with compared to notepad below:

There are a lot of other good Notepad replacements out there, but I happen to like this one the best.

In the 90′s two major changes happened that basically killed FTP:

1. Firewalls were making their way corporate network perimeters. With the www introduced in 1990 it wasn’t long before companies were becoming ‘connected’. With this new form of communication came new security risks, and of course new security measures. Firewalls were the cure-all security solution of the 90′s.
2. NAT was being used so corporate computers could utilize a private IP over the Internet. NAT’s were configured on network devices such as routers, proxy’s, or even firewalls.

To illustrate why FTP is no longer a valid protocol its time look at how FTP works on a basic level. There are two modes for transferring data via FTP: PORT (active) and Passive.

PORT (Active) mode FTP

Here is a sample of PORT (Active) mode communication initialization:

1. FTP client connects to a server.
   1. The source port for the client is a random number over 1023, this port will be used for commands on the client side.
   2. The destination port on the server is 21, this port will be used for commands on the server-side.
2. The server replies to the FTP client on the client control port.
3. Server initiates data connection to the clients data port.
   1. Server data source port is 20
   2. Client data port is client control port plus 1
4. Client Acknowledges the data ports to be used.

Here is a sample of the above:

***note: For this example I chose 1024 for the RANDOM client control port, which in turn caused the client data port to be 1025

PORT (Active) mode FTP sample

As you can see above the client side of FTP communications in PORT mode has a random port assigned. Also notice the FTP server initiates data connections, even though it was the client that initiated the control connection.

This is what causes many problems with getting FTP through firewalls. Typically a server would only be allowed to access certain ports through a firewall, if at all. Since the data port is a random number over 1023 it is unlikely the server can send data via FTP using Active Mode.

NAT will also have problems in the above scenario because the IP and port being referenced in the control will be the Private IP and port, as opposed to the Public IP and port.

The point is: If you have an old application that is using PORT mode, get rid of that application!

Passive mode FTP

Passive mode overcomes some of the limitations of Active mode. Here is a sample of Passive  mode communication initialization:

1. FTP client connects to a server.
   1. The source port for the client is a random number over 1023, this port will be used for commands on the client side.
   2. The destination port on the server is 21, this port will be used for commands on the server side.
2. The server replies to the FTP client on the client control port.
3. Client initiates data connection to the server data connection port.
   1. Client data port is client control port plus 1
   2. Server data port is a random number specified by the server
4. Server Acknowledges the data ports to be used.

Here is a sample of the above:

***note: For this example I chose 1024 for the RANDOM client control port, which in turn caused the client data port to be 1025

***note: For this example I chose 2048 for the RANDOM server data port.

Passive mode FTP sample

As you can see above the client side of FTP communications in PORT mode has a random port assigned. With Passive mode the servers Data port is also random. Also notice the FTP client initiates data connections, which is the opposite of how Active mode sessions work.

With Passive mode the FTP administrator can set a range of ports to choose from for data connections. These ports can in turn be allowed through the firewall by the Network Administrator. This overcomes the issues caused by firewalls that causes Active mode to fail.

From a network security perspective this is not a good solution. It means opening more ports on the firewall, a rather large amount of ports actually!

It’s also a pain to troubleshoot FTP issues. Many times you will be working with applications that only support Active FTP. Or maybe you’ll have a client that supports Passive FTP but the firewall on either end is still unable to make a proper connection.

The point is: If you have an old application that is using FTP (Active or Passive), get rid of that application!

Alternative to FTP

Here we are 15 years after FTP should have been dead and developers are still using it. Recently I asked a developer why he was using FTP. His simple answer: FTP is simple to use/implement and it’s what I’ve always done. (I really hate the “its always been that way” answer).

There is a good alternative to FTP, it’s called SFTP. SFTP stands for SSH file transfer protocol (not secure file transfer protocol as some might think). SSH stands for Secure Shell. SSH provides a secure connection for the file transfer. Even if you don’t think any data being transmitted needs to be secured, it’s a good idea to always use secure communications.

SFTP is not simply FTP implemented with security. Let me repeat SFTP is NOT a new implementation of the older FTP specification. Instead SFTP is a new specification that has all of the capabilities the older FTP specification. In fact the same commands are available for use. For developers there is very little that need be done differently to use SFTP as opposed to FTP.

Also, there are no longer different control and data streams. The server has only one port, typically 22, the same as other SSH protocols. No more mucking around with random server ports or having to troubleshoot passive connections!

I won’t go any more into why SFTP is a good replacement for FTP. If you want more info on SFTP I would recommend going to the OpenSSH website or RTFM on the OpenBSD website.

One final plea: Developers, please STOP using FTP.. its dead, or at least should have been dead 15 years ago!!!