Diary of a Network Geek

Let’s start the year slow.

So, I’m sure a lot of you got new PCs or laptops, or upgraded your old ones, this holiday season.  Maybe it was a Christmas gift.  Maybe a Christmas gift to yourself.  Maybe you just took advantage of the post-holiday sales.  Whatever it was or how ever you got it, you probably are feeling the pain of reinstalling all those “essential” programs that you use on a regular basis.  Things like Firefox and Mozilla or Chrome and Skype or Winamp or Flash or .Net or iTunes or LibreOffice or any number of similar little things.  You’ll be feeling the pain of having to go to all those individual websites to collect the various install files to run.

Well, I have the solution to the problem you didn’t realize you had.  It’s a little site called “Ninite” and they call themselves “…the fastest way to install, reinstall or upgrade free software”.
You go to the site, check the different bits of software and click the “Get Installer” button and the site will serve up a downloadable installer file that will install the free software you checked on the form.  You run the file and your software gets installed.  That simple.  Oh, and the basic service itself is free.
Now, if you want to maintain that free software and keep it updated, they have a very reasonable service for that, too.  For the personal edition for a single computer, it’s just $9.99 a year, at the moment, but, of course, that may change.

Both the free and pay services are available for Windows or Linux, which I think is pretty damn extra cool.

Anyway, there’s your first fun/cool/useful link for the new year.  I think it bridges the fun, the free and the very geeky stuff that this blog is, I hope, known and appreciated for sharing.
Happy New Year everyone!

Hackers are porting Linux viruses (virii ?) to OS X.

Last week Monday, ZDNet reported that hackers have ported code for a trojan from Linux to Apple’s OS X.  For those of my readers who don’t know what a trojan is I’m referring to a malicious program that opens the door for other, usually even worse, programs to come into the infected operating system, like the Greeks did in the classic stratagem known as the Trojan Horse.  It hasn’t been seen in the wild yet, but apparently the C source code for this has been available for quite some time.

Frankly, I’m surprised that this doesn’t happen more often than it does.  In the old days, virus writers had to really know something because they used assembly to create them.  Now, with Windows and all the other object-oriented programming languages filled with bloated libraries of programming calls, along with the availability of existing code on the internet, they hardly have to know anything to write fairly nasty malware.  And, as I’ve mentioned before, as Apple laptops become more popular, more malware will start to show up there.  I’m sure it’s only a matter of time before they figure out how to infect iPads and iPhones, too, if they haven’t already.

I hate people like this.
I spent most of my day today cleaning a malware infection off a machine.  This little bugger had not only disabled the Windows Task Manager, which is pretty common these days, but it also cleaned out the Start Menu, including all the built-in things like the link to Control Panel and My Documents and all those things on the right side of the Windows XP default Start Menu.  But, it also flagged most of the drive as Hidden and System, making it even more difficult to load the software I used to clean it.  I had to go into Safe Mode just to get the system clean enough to restart into Safe Mode with Networking so I could update Malwarebytes, which is what I eventually used to get rid of the beastie.   (I used Spybot Search and Destroy to keep the malware from loading to make the machine useable with networking support so I could update Malwarebytes, incidentally.)
So, yeah, these slimeballs keep me in a job, but, really, I’d appreciate it if they stopped helping me stay employed.  I promise I can find plenty of other things to do!

So, look lively out there people!  Be suspicious of what you download and click on!

UPDATE:  Apparently, this has been found out in the wild now.  And, according to TechWorld, it has a purpose; to use your system to generate BitCoins for it’s evil masters.  Very clever.  Nasty, but, still, very clever.

I hope so!

And, by that I mean, I hope all that Mac Malware we heard about a couple weeks ago is gone.
Now, I know several Mac fanboy blogs linked to the note I put up about the Mac malware some time back thought I was going out of my way to bash Apple, but, honestly, nothing could be further from the truth.  In fact, I hadn’t given it another thought until Ed Bott wrote “Where did all the Mac malware go?”  I threw the original story out there as a warning to all the Apple users who think the Mac and OS X is entirely free from any malware and utterly safe.  That’s just not true.  It is, I have to admit, much safer, in general, than Windows.  There are a couple reasons for that, but, mostly, it’s because of market share and how Apple does, well, everything.

So, that last explosion of malware may be the only shot you hear fired.  At least, for a while.
Frankly, I hope so.  And, I hope that it put enough scare into people that they take security seriously anyway.  As Apple’s market share grows, their products will all become a more appealing target for hackers and crackers.  Though I hope to be proven wrong, I suspect that there is malware being written to attack Macs and, possibly, iPhones and iPads.   In fact, that malware may be already written and just waiting for the right infection vector.  Maybe.

Maybe I’m just a bit cynical and I’m waiting for the proverbial other shoe to drop.
For years, Apple fanboys have told people that Macs were completely virus free and were more secure by their very nature.  Sadly, that’s not true.  We’ve heard the first shots fired in a new skirmish in the secret war for desktops of all kinds.  It’s big business.  I don’ t think this is the last we’ve heard about Mac malware.
But, maybe I’m wrong.  Maybe Apple has closed that hole and all the other holes, too.  Maybe the Macs are all safe and that’s why we haven’t heard about that malware recently.
Maybe.

But, can you afford to take the chance?

I told you Macs weren’t safe!

Does anyone listen to me?  No.  Well, hardly ever.
I’m sure you’ve seen the news by now that there are growing numbers of Mac malware attacks.  In fact, Apple Care, the official Apple customer service division, has reported a staggering jump in the number of malware related calls they received in just the past several weeks.  Apparently, according to the interview, it’s gotten to be quite a large problem in just that short amount of time.  They estimate that, now, up to 50% of all calls they get are related in some way to a malware attack on an Apple product.  The indication from the article is that everything is focused on Mac OS X machines, but, with larger market share comes a bigger prize for hackers, so don’t be surprised if iPhones and iPads and even iPods are attacked next!
Of course, what makes matters worse is that, allegedly, Apple Care representatives are being told not to help with malware attacks!  So, all that safety you thought you were buying with Mac?  Apparently, not the best investment.  Of course, security through obscurity never is.

So far, the threat seems to be confined to a single, aggressive bit of malware called MacDefender.  Go to the link and you’ll see a screenshot of what it looks like when it tries to install.  It looks just like a standard Mac program, right from Apple.  This is the same tactic that Windows users have been facing for years.  There’s nothing new here, outside of a new installed base of users who have never had to deal with malware before.  Mac users must look like sheep ready for fleecing to these crooks.  So, if you know Mac users, warn them and spread the word.

For those of you lucky enough to have escaped harm so far, buy and install an antivirus product and keep it up to date.
For those of you who haven’t been lucky, here’s a link to a MacDefender Malware Removal Guide. (Thanks, @joefarace!)

Incidentally, I’ve been talking about this for years.  I knew it would happen eventually, but, hey, who am I?  I mean, besides a front-line grunt that cleans up everyone’s machine when they get infected with digital herpes.  Not being a “pundit” or “respected industry figure” just means that no one takes you seriously, not that we don’t know what we’re talking about.  Because, believe me, I’m not the only network geek in the trenches who saw this coming.  We ALL did, but no one listens.

Like I wrote earlier, get the word out and show Mac users what they might expect before they get hit.
The day you save may be your own!

Remember, these are “administrator utilities” not “hacker tools”.

In my business, it pays to make the distinction.
When people call me for help outside the office, the calls usually fall into a couple categories; a virus, a slow computer, a lost password and “how do I do X?”  Sadly, I’ve been doing a lot of virus and spyware removal, but, also, lately, I’ve had a couple of “lost password” calls.  I actually love getting those, for a couple reasons.
First, lost passwords are surprisingly easy to recover if you have physical access to the machine.  It’s funny to me how few people get that.
Secondly, I find recovering passwords fun.  In a way, it was one of the first things that drew me into the business.  I was one of those guys who got hooked by the security bug not by War Games, but by Sneakers.  Yeah, I know, most guys my age especially will tell you it was War Games that really got them hooked.  What can I tell you?  I’ve always been kind of a late bloomer.  And, my dirty, little secret is that after seeing Sneakers, I wanted to be Marty Bishop.  Seriously.

Anyway, my recent experience with Windows password recovery requests gave me an opportunity to refresh my tools.  After Googling a bit, I found a handy About.com page titled “Top 6 Free Windows Password Recovery Tools“.  I downloaded several, most of which were based on bootable CDs of one kind or another.  I like those kinds of toolkits because they don’t require even limited access to operating system, just the ability to reboot the machine from the CD toolkit.
In the end, I tried two; 0phcrack and the Offline NT Password & Registry Editor.

Now, I’m not positive, but I’m pretty sure that 0phcrack is the free, opensource fork of l0phtcrack.  Now, for an old-timer like me, l0phtcrack was THE password cracker to have, back in the day.  Created by a group of well-known hackers, some of whom famously testified before Congress, it was not free.  At least, theoretically.  If you knew where to look, you could get copies.  And, yes, I  them.  But, this version IS free and seems like it had some improvements.
For one thing, the old version had a slightly clumsy text-based interface.  This version has a much nicer interface that seems to use X-Windows.  It’s also far more intuitive to use.  It ran pretty fast, really, though, sadly, didn’t seem to be able to crack the non-dictionary word used as a password on the Windows 7 box I was using it against.

On the other hand, the Offline NT Password & Registry Editor has been around for several years, and had several updates, though it retains the text-based interface.  I don’t remember when I used this the first time, but, so far, it hasn’t let me down in a pinch.  This time was no different.  So, yes, even though it has “NT” in the name, I’ve used it on everything from Windows 2000 through Windows 7 without a hitch.  Of course, your results may vary.  The bonus of this product is also it’s most potentially dangerous drawback; it directly edits the registry and password files.  This is dangerous, in a way, because if something goes wrong, this could, theoretically, lock you out of your machine permanently.  In practice, this has never actually happened to me.
One advantage of this utility is that you can change or simply remove the password for any active user on the system.  Also, you can use it to promote an active user to being an administrator equivalent.  Now, by “active user” what the developers mean is any account that is not disabled.  Though, I think there may be the option to activate a deactivated account.  I’m not positive, though, because I’ve never had to look for it or try to use it.  And, yes, this worked like a charm to simply blank the password on the Windows 7 machine that had apparently forgotten its own password.

So, there you have it.  Two tools to recover lost Windows passwords.
Oh, and, just a quick disclaimer here.  I’m not responsible for any damage you might accidentally do to your machines with these utilities.  Nor am I advocating using them to break into your ex-spouse’s computer to read their adulterous e-mail to their lover.
I’m just sayin’….