“Free” antivirus software packages
November 6th, 2008
The word “free” is always dicey when you talk about computer software. Usually, free software is a loss-leader for the software company, and such software often comes bundled with stuff which tries to separate you from your money later on. And, in the worst cases, this “stuff” is spyware, which spies on you, trying to figure out how to sell you more stuff.
Nevertheless, there are some computer security companies which make available some good antivirus software, and they give it away to home users. Those companies hope to make money later, either from upgrades, or indirectly as a marketing cost leading to higher trust levels (for instance, tech people buy their software for non-home situations) I often will recommend these packages to my clients, and they work well in a pinch.
The biggest problem with these programs is that they can turn into “nagware” – that is to say, they start nagging you to buy an upgrade. AVG, for instance, used to be pretty quiet, but now (in 2008) its newest version is total nagware.
- Avast! 4, from the Czech company Alwil. http://avast.com/eng/download-avast-home.html The main annoyance with this software is the yearly registration requirement, but that is no more or less annoying than some website registrations.
- AVG Free, also from a Czech company, AVG (formerly Grisoft). http://free.avg.com/download-avg-anti-virus-free-edition — AVG has been amping up the upgrade nags quite a bit lately, so if you install this, be prepared.
- Comodo Internet Security: http://www.comodointernetsecurity.com/download_cis.html — This program is a bit technical and geeky, but its latest upgrade strikes me as worthwhile.
There are a few other currently free antivirus software packages – for instance, Avira AntiVir and Eeye Blink – but I can’t say anything one way or another on those two.
LogMeIn: good stuff
December 3rd, 2007
Thought I’d give a shout-out to the makers of LogMeIn (http://logmein.com), who have come up with a useful free version of a product which turns out to be more handy than my previous option (a combination of DynDNS, VNC, and fiddling with routers).  In the span of 3 months, I went from not using it at all to having more than a dozen systems on it.  (It even has a Mac version, in beta, which I can use to remote-control my media-laden MacMini.)
About two years ago, I tried to get Hamachi working — that was the original project by this company, so far as I know. Frankly I was left a little baffled, and ended up using the old standby, OpenVPN. However, compared to Hamachi-of-two-years-ago, LogMeIn is wonderfully slick.
I foresee a time when I’ll be using its Rescue, Pro, and Backup versions — there are situations appropriate for those kinds. (Pro allows you to locally print off a remote program; Rescue lets you help people remotely without an install; Backup does what backup implies — competitor to Mozy?) But for now, LogMeIn is good enough to keep me from exploring further VNC, PCAnywhere, Connect, Remote Desktop, SharedView, WebEx, or Glance. In the future, those will surely become part of the mix.
Malicious website advertisements: new trends
November 19th, 2007
A client of mine ran into an odd event last week: the computer seemed to be infected either with a virus or with an anti-virus program which wouldn’t shut up.
After looking at it a bit, I had to shut down the web browser, and though I couldn’t find any malware, I made sure her workspace was over at a non-admin account.
Now today, I find that reputable websites (that is, if mlb.com and canada.com are reputable) are serving advertisements from doubleclick — and those ads are the culprit. This youtube video shows what happens.
What can you do? Well, we are now in the age of cross-site web programming, wherein almost all websites are assembled together on the web browser to create one’s internet experience. You have to assume that even responsible websites will be using scripts, videos, or widgets from other sites. And you also have to assume that they won’t catch everything. So: you have to practice safe browsing, now more than ever. This means one thing, above all:
Don’t browse the web when you’re using your computer in a profile or account which can make widespread changes on your machine. (These are usually called “administrative” accounts.)
If you do, well, you’ll be paying someone to clean up your machine sometime soon.
Small-to-medium business uptake of linux?
April 17th, 2006
http://www.zdnet.com.au/news/software/0,2000061733,39187298,00.htm brings up an interesting issue. Part of the topic really is a lack of management at such places. The types of tasks which need to be done in the enterprise haven’t been analyzed, and thus employees are allowed to do basically anything they want with their machines. They consequently are encouraged to rely on any old application which comes their way, and get hooked to it.
SMEs really need to have a sense of what computers will do for their enterprise. Why do they have computers, and how do they add to the bottom line of the company? That reasoning then should have impacts with employee job roles and with information technology spends, no matter how small.
If an employee truly only needs to work with a web browser and with a spreadsheet, it is ridiculous to use a Windows machine. Technology choices should then go from there.
Employees will simply learn to copy, whatever the tasks. If Mozilla and OpenOffice are given for tasks, then the employees will cope. Once that is all they use, then if they show up one day and all their data is on a server of some sort (IMAP, shared backed up server, etc.), and they can still run Mozilla and OpenOffice, then there you go.
The “gravy” (media players, chat software, etc.) really can be duplicated for free on linux without incident. Be better, in fact.
This form of thinking can apply to lowering one’s Windows spend as well. There are open source alternatives on Windows, and they should be used as much as possible. Start with OpenOffice, Thunderbird, and Firefox. Gaim if you need chat. MS Access is still handy on Windows — a MySql/OpenOffice emulation is on its way.
SCP Hints
April 17th, 2005
Just a few quick speed hints for using SCP, which came my way:
The -C flag will tell SSH/SCP to compress stuff. In general I use it
all the time. CPUs are so much faster than networks still so
compression is your friend.Depending on your platform, using the blowfish cipher should be a little
faster than using the default 3des or aes128 (don’t quote me on the
aes128 claim, they’re both pretty close).Most people don’t realize, but you can configure all sorts of options on
a global and a per host level in your ~/.ssh/config file. This is nice
because you can force it to use a different port for certain hosts,
different ciphers, not allow password, only forward X for some hosts,
etc.Here’s a little snippet to drop in your ~/.ssh/config that will make you
use blowfish for your cipher and compress all data going over the
network with GZip at level 6.Host *
Compression yes
Ciphers blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbcI’m actually a little confused about why exactly this works, as the docs
say it is only for SSH1 and not SSH2, but testing a 11 meg text file
(about 20 copies of Huckleberry Finn repeated over and over), with
compression gave me an overall throughput of 90.6K (11 megs in 1 minute,
51 seconds), without compression gave an overall throughput of 32.8K (11
megs in 4:58). Totally non-scientific, but good enough for me to
conclude that it’s doing something, especially considering that my cable
modem says that it’s current upstream rate 384000bps.At this point, I’ll also throw in a quick plug for using mod_gzip (or
the equivalent) on your servers, especially if hosting them over a cable
modem. For simple HTML you’ll usually get compression rates of about
66% or so. Works great for my server hosted on my cable modem, keeps
the pages zippy. Most clients support this (yes, even IE supports
compression of data).
Open source in the police department
April 17th, 2005
What I appreciate about this article over at RedHat (as I read):
1. This guy clearly will bounce between operating systems. He mentions “MSYS” (http://www.mingw.org/download.shtml) which also should be in one’s bag of tricks with cygwin.
2. He is willing to consider some old 8086 machines and dot-matrix printers as potential time-saving tools.
3. He mentions the Penguin Sleuthkit, which looks great as a forensic tool. It is incredibly important to use tools which protect the integrity of the scene — there can be no question of tampering with anything. This kit looks like it has the tools one would need to do a rapid look-over.
Lighter-weight linux distributions
October 19th, 2004
The linux world, in its fight to act like a point-for-point rebuttal to the Windows and Mac worlds, are busily adding features and bloat to desktop offerings. However, in the process, a regular mainstream Linux distribution like Mandrake or Red Hat take as much, and at times more, memory and processor speed as a Windows XP distribution does.
This came as something of a shock to me. Fedora just doesn’t run very well with 128MB, and barely does with 256MB. Yet, part of my reason for getting involved in the Linux services world is my belief that Linux is an excellent fit for older hardware. In other words, all those dusty computers from two generations ago, those Pentium Ones with 64MB RAM, could still be productive machines today.
Well, maybe so, but not with a recent mainstream distribution. Those distributions will occasionally work with older machines, especially if all you need is a really slow httpd or mysql server, but not (or not really) with a windowing environment. And if you can’t deal with something other than Gnome or KDE, well, forget it.
To figure out what to suggest to clients, I did a search on the state of the art in lighter-weight distributions.
PUPPY LINUX
Over at http://www.goosee.com/puppy/, this developer decided he wanted to take his operating system and his personal files with him in a USB 128MB pen drive. Along the way, he ended up making a fast and functional linux distribution.
It is especially usable for newbies, since it uses the MS Windows ‘clone’ Fvwm95. Much else is nice about it, and there is plenty to explore. It needs to be tested with dialup connections, but that is about it.
FEATHER LINUX
Ever wonder why Klaus Knopper has to put all that stuff into Knoppix? Well, he doesn’t, and never said that he did. You always could roll your own. Can now, too.
Feather Linux is an attempt at removing enough from Knoppix to make a slim and usable Linux distribution. It has only gone through one revision (it is at 0.1 as of 10/2004), but it is one to watch. Try it out at
VECTOR LINUX
Vector Linux is one of the original distributions aimed at older computers. Its installer leaves plenty to be desired, and requires a bit of an enthusiast’s or an expert’s knowledge of how disk drives work; it as well gives some choice as to which windowing environment one wants to use, which will be non-intuitive for most folks. Generally, however, it shows the way to how to build a distribution with lower-end computers in mind.
The Linux Terminal Server Project (LTSP)
Some computers are too old really to do much at all, or for some offices, it doesn’t make sense to maintain applications and settings on a several computers. That’s where LTSP comes in, offering packages which allow you to set up computers to run off a server, without a disk involved. Basically, any program runs only in RAM on a workstation, and therefore most everything (beyond floppy disks) will be stored on the server. This eases application maintenance, backups, and allows companies to clearly set rules on what is allowable to install and what isn’t.
A wonderful use of an old computer — set it to boot from network!
Open Source Security
April 19th, 2004
Open Source Is Fertile Ground for Foul Play contains important security concerns. One part of the Total-Cost-of-Ownership will be, basically, open source code auditing, for those companies who go that route. No way to gloss over that. It is most certainly possible to inject malicious code into distributions, but you will certainly have to make it past the review systems of the packages/distributions themselves (including MD5 checksums, diff reviews, the rather efficient ways in which vuln information works its way around the open source community, etc.).
As more companies go the open source route, however, they will have an economic incentive to keep the code clean. For instance, MySql would have a big problem on their hands if something happened to the MySql codebase. RedHat would if Postgresql had a problem. Mandrake if KDE had a problem. Thousands of companies, if Apache, PHP, or Python had a problem.
Fedora and Win2k3 don’t have many because they are relatively new. Fedora for one will certainly have scads, hundreds, and you’ll get hosed if you don’t keep things updated (and as much as possible shut off and/or removed from the system).
One interesting aspect is that many vulns have to do with optional, separable pieces of the distribution. For instance, if OpenSSH has a vuln of a certain version, it will touch Debian, Slackware, RH 9x, Mandrake 9x, etc. etc., but obviously SSH might or might not be used on a system. Same for PHP, which is part of almost all the dists. But only a certain subset of installations use it for anything.
To apply this to RH 9.0: Many RH 9.0 vulns (Xpdf, mutt, sendmail, postgresql, ethereal, etc.) won’t apply, depending on what you’re running. But the idiot factor will be in play; if you install a dist but then don’t remove/turn-off what you’re not using, then you’re in trouble.
(P.S. Nice Response: Who’s guarding the guards? That would be us)
Bootable Linux
March 2nd, 2004
One of the most enjoyable and potentially useful bits of linux paraphernalia has been the explosion of “bootable linux” distributions. For quite a while, the main ones which were well known were tomsrtbt and Knoppix. Since a couple years ago there has been a truly wonderful proliferation of bootable distributions, with more created all the time.
There are several direct and obvious benefits to bootable linux distributions:
- You can have a special-purpose linux dist for a single task
- You can boot up linux on basically any machine, or at least find one that works, and so work in a familiar linux environment wherever you are
- You can try out several distributions, in the spirit of getting more familiar with them
- The bootable media is (almost always) read-only, so it won’t change or get damaged due to user error or playing with configuration settings — just restart and you’re back to where you began — thus, the bootable linux firewall: in the event of a security intrusion, reboot and you’re back to where you were before the intrusion — bad for forensics but good for uptime and recovery
Anyway, here are a few of the up-and-coming ones, well, at least according to Jeff Honnold’s spindle of CDs:
MandrakeMove: this is the bootable CD from Mandrake, that wacky French company which makes one of the best and most user-friendly distributions currently.
PHLAK, a.k.a. Professional Hackers Linux Attack Kit: yes, if you want to set up a bunker and start your intrusion tests as a White Hat security consultant, this is one of the dists you’ll have in your spindle.
MenuetOS: Joe Lazar just mentioned this to me, currently playing with it.
MEPIS: out of Morgantown WV, of all places. Am thinking of making a pilgrimage down there.
Movix: great for playing your media
UPDATE:
Slashdot discusses a review of 18 live CDs; lots to choose from!
spamku!
January 19th, 2004
Habeas apparently makes their money by giving folks tools to receive email which is ‘wanted’. Hilariously enough, however, one of the main ways they accomplish this is by: inserting a haiku into the headers of an email! A recent spam to my account showed the poetic verve of the company:
X-Habeas-SWE-1: winter into spring
X-Habeas-SWE-2: brightly anticipated
X-Habeas-SWE-3: like Habeas SWE ™
X-Habeas-SWE-4: Copyright 2002 Habeas ™
X-Habeas-SWE-5: Sender Warranted Email (SWE) ™. The sender of this
X-Habeas-SWE-6: email in exchange for a license for this Habeas
X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant
X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this
X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/.
Well, I don’t know about anyone else, but isn’t it obvious that headers of email can be forged five ways to friday?
So no one should be shocked, SHOCKED, that some spammers have figured out that by including these headers, spam filters can be bypassed. Comic relief, spamku style (thanks Dan Sparvero for the word “spamku”!), is to be found here: http://www.theregister.co.uk/content/55/34969.html