Diary of a Network Geek

I hope so!

And, by that I mean, I hope all that Mac Malware we heard about a couple weeks ago is gone.
Now, I know several Mac fanboy blogs linked to the note I put up about the Mac malware some time back thought I was going out of my way to bash Apple, but, honestly, nothing could be further from the truth.  In fact, I hadn’t given it another thought until Ed Bott wrote “Where did all the Mac malware go?”  I threw the original story out there as a warning to all the Apple users who think the Mac and OS X is entirely free from any malware and utterly safe.  That’s just not true.  It is, I have to admit, much safer, in general, than Windows.  There are a couple reasons for that, but, mostly, it’s because of market share and how Apple does, well, everything.

So, that last explosion of malware may be the only shot you hear fired.  At least, for a while.
Frankly, I hope so.  And, I hope that it put enough scare into people that they take security seriously anyway.  As Apple’s market share grows, their products will all become a more appealing target for hackers and crackers.  Though I hope to be proven wrong, I suspect that there is malware being written to attack Macs and, possibly, iPhones and iPads.   In fact, that malware may be already written and just waiting for the right infection vector.  Maybe.

Maybe I’m just a bit cynical and I’m waiting for the proverbial other shoe to drop.
For years, Apple fanboys have told people that Macs were completely virus free and were more secure by their very nature.  Sadly, that’s not true.  We’ve heard the first shots fired in a new skirmish in the secret war for desktops of all kinds.  It’s big business.  I don’ t think this is the last we’ve heard about Mac malware.
But, maybe I’m wrong.  Maybe Apple has closed that hole and all the other holes, too.  Maybe the Macs are all safe and that’s why we haven’t heard about that malware recently.
Maybe.

But, can you afford to take the chance?

I’m seeing traffic about this, so I thought I’d write up what I found.

I tweeted about a strange DNS-based network/malware attack that I saw on Friday, but, at the time, I didn’t see any interest, so I didn’t go into any real details.  Besides, I may be a hardcore geek, but I do have a life and was going out.  But, now, I’m seeing search engine traffic hitting my blog apparently looking for details, so I thought I’d describe the attack, as I saw it.

First of all, let me mention that I’ve seen a higher-than-usual occurrence of malware infections the past couple of weeks.  I mean, it’s a hazard of my business that, sooner or later, people are going to get infected, either through bad behavior or by accident, but the past three weeks or so I’ve seen way more problems like that than is even remotely normal.  So, bearing that in mind, I’ve been on a kind of high-alert status looking for any malware problems, but this was something new.

It started with someone from another location, who’s on a totally, physically separate network which uses a different internet service provider to connect to the Internet, calling me with a problem.  It was, apparently, a recurrence of a virus he had previously that we cleaned.  He described being taken to a webpage that featured a maroon graphic background with a white icon of a policeman holding up his hand to indicate “stop”.  The text on the page gave a message that said the user’s browser was not the correct version to access the page and that an upgrade was required.  Helpfully, it provided a button to press to receive the “upgrade”.  Obviously, the “upgrade” was an infection.  (You can see an example of the graphic here.)  Thankfully, I trained my users well enough to be suspicious of these kinds of things and no one who reported this actually clicked on it.

About the same time this happened, I noticed that my iPhone wasn’t connecting to the wifi hotspot I have setup in my office.  I checked the configuration and noticed that the DNS servers listed were wrong.  In fact, they’d all been replaced with a single DNS server; 188.229.88.7  Obviously, that seemed suspicious to me, so I opened a command prompt on my PC and did a tracert to see if I could figure out where this server was and, from that, why it had become the default DNS server on part of my network, despite my having very carefully configured totally different DNS servers that I knew were safe.  It looked like the tracert results showed me a network path that led out of the country somewhere, which was, to me, very suspicious.

Before I could really pursue that, though, I got another call from a user at my location reporting the exact same error message and graphic, but going to a totally different website! I went to his computer and checked the IP configuration and found that his DNS servers had been replaced by the rogue server as well.  I refreshed his network config, several times actually, and the DNS servers reset, but, when I thought to check some other people in the same area of the building, his configuration set itself back to the rogue DNS server!  So, I reset the local network equipment to clear the DNS cache, and whatever other caches may have gotten poisoned by this attack, and the problem seemed to go away.  Unfortunately, whatever had caused the compromise was still active and seemed to poison the DNS cache and the DNS configuration again.  It did seem sporadic, though, as if the ISP was trying to correct the issue at their end.

As far as I can tell, the attack actually seemed to be network-based in some way.
At least, I couldn’t find any computer on my network that was infected with anything that AVG, Norton Anti-virus, or Malware Bytes could find.  It is, I suppose, possible, that this attack was so new that no of those programs had an updated detection pattern for it, but, based on the lack of detection, and the fact that it happened on two physically separate networks almost simultaneously, leads me to believe that this was a network-based attack.  I suspect that an ARP cache or DNS cache or something similar was attacked and compromised on a major network router somewhere.  Possibly one of the edge routers at a trans-continental connection somewhere.  From the tracert results I had, it looked like it was the East Coast somewhere, leading to Europe via London to France, though I could be wrong.  It’s possible that was a blind alley meant to throw researchers off the trail in some way.
Also, as of this writing the rogue DNS server seems to be out of commission, though that might change, too.

The Internet is a wild and wooly place, ladies and gents, and you can’t always count on your friendly, neighborhood Network Geek to watch over you and keep you safe!  So, be careful out there!
(And, if you’re a fellow professional who’s seen this, too, leave me comments and tell me what you found!)
UPDATE: Looks like the server is still active, but my ISP has blocked DNS traffic to it, to fix the problem.
Also?  I hate the bastards that do these things.  I hate every last one of the little rat bastards!

UPDATE/FOLLOW-UP: So, it seems like a lot of people have been effected by this problem!
Check the comments for what other folks did and tools they might suggest to help with the problem.  Frankly, I wish I’d had known about those tools when I started my day!  Yes, I was *totally* wrong when I said it looked like it was coming in from outside the routers.  It was, in fact, *several* PCs that were infected with whatever it was.  I found it, much like at least one commenter, by checking the results of “ipconfig /all” in a command prompt.  I noticed that the DHCP server listed in the config was NOT my actual DHCP server!  So, as I went from machine to machine, I saw several PCs that kept coming up as DHCP servers.  I used Malware Bytes to scan the infected PCs and it seemed to clean them off.  At least, for now.  I’m not sure what I’ll find in the morning.
Apparently, Friday, when it looked like the problem was getting cleaned up, it was really just people shutting their workstations down early for the long weekend.
In any case, as at least one commenter has mentioned, it looks like updates for the various scanners should be coming out this week, so keep updating your antivirus and antispyware programs and scan your networks!  Well, scan them more completely and carefully than you already have.
And, as always, if you have any new information or suggestions for tools to clear up the issue, please, leave them in the comments!

Good news!

First, there are things you can do to protect yourself from this new Mac malware:
Start by disabling the automatic opening of downloaded files.  The world has changed for you Mac users and you simply can’t trust just any download any more.  Welcome to the world that Windows users have lived in for years and years.
Also, don’t let things install on your machine unless you’ve gone out looking for them!  Again, don’t trust anything that looks like an automatic update or a “free” program that wants to install automatically, especially if you haven’t been searching for any thing!
Seriously, you can’t trust people on the Internet.  I know this may come as a shock to the Hippie, “free-love” sort of people Mac users think themselves to generally be, but, yeah, not everyone on the Internet has your best interests at heart.  Well, except me.  You can trust me.  Honest.

Secondly, in a “few days” Apple will allegedly put out an update to make you safe again.
At least, that’s what they’re saying.  No definite deadline on that, though, so be careful and make sure to check your updates regularly!  Staying up to date on patches is one of the better ways to help prevent an infection.  Also, if you haven’t already, please, consider getting an anti-virus program for your Mac.  OS X is a growing target for hackers as the installed user-base grows, so, sooner or later, you’ll see more of these little nasties coming your way.  Your platform’s growing popularity will make it a growing target!  So, before it’s too late and you’re asking your friendly, neighborhood network geek for help in cleaning up the mess, install an anti-virus to prevent the mess in the first place.  The computer you save may be your own!

I told you Macs weren’t safe!

Does anyone listen to me?  No.  Well, hardly ever.
I’m sure you’ve seen the news by now that there are growing numbers of Mac malware attacks.  In fact, Apple Care, the official Apple customer service division, has reported a staggering jump in the number of malware related calls they received in just the past several weeks.  Apparently, according to the interview, it’s gotten to be quite a large problem in just that short amount of time.  They estimate that, now, up to 50% of all calls they get are related in some way to a malware attack on an Apple product.  The indication from the article is that everything is focused on Mac OS X machines, but, with larger market share comes a bigger prize for hackers, so don’t be surprised if iPhones and iPads and even iPods are attacked next!
Of course, what makes matters worse is that, allegedly, Apple Care representatives are being told not to help with malware attacks!  So, all that safety you thought you were buying with Mac?  Apparently, not the best investment.  Of course, security through obscurity never is.

So far, the threat seems to be confined to a single, aggressive bit of malware called MacDefender.  Go to the link and you’ll see a screenshot of what it looks like when it tries to install.  It looks just like a standard Mac program, right from Apple.  This is the same tactic that Windows users have been facing for years.  There’s nothing new here, outside of a new installed base of users who have never had to deal with malware before.  Mac users must look like sheep ready for fleecing to these crooks.  So, if you know Mac users, warn them and spread the word.

For those of you lucky enough to have escaped harm so far, buy and install an antivirus product and keep it up to date.
For those of you who haven’t been lucky, here’s a link to a MacDefender Malware Removal Guide. (Thanks, @joefarace!)

Incidentally, I’ve been talking about this for years.  I knew it would happen eventually, but, hey, who am I?  I mean, besides a front-line grunt that cleans up everyone’s machine when they get infected with digital herpes.  Not being a “pundit” or “respected industry figure” just means that no one takes you seriously, not that we don’t know what we’re talking about.  Because, believe me, I’m not the only network geek in the trenches who saw this coming.  We ALL did, but no one listens.

Like I wrote earlier, get the word out and show Mac users what they might expect before they get hit.
The day you save may be your own!

The myth of an operating system that is somehow safe from virii or malware is being busted.

No, seriously, I know all you Mac users are always bragging about how much more safe your operating system is because there isn’t any malware written to attack it.  I hear it all the time.  Well, guess what kids?  You’re wrong.  There is at least one OS X Crimeware Kit, in the wild.  And, really, that’s just the one that we’ve seen lately.  If researchers have found one, there are probably others.  And, I know that there are other exploits in the wild, too.  Not as many, sure, but they are out there.  And, thanks to you all bragging about how you’re safe and being all fan-boy about your OS and telling all your friends how great it is, you’re making OS X a more and more attractive target all the time.
Remember, the reason that Windows has so many exploits written for it is because it’s installed on so many computers.  It’s marketing, really.  Where’s the biggest potential market for software?  Right, on the biggest installed base of whatever the popular operating system is.  Now, if you were a virus writer, what would you write a virus to run on?  Same thing.  So, as markets expand, so will the exploits.

Brace yourself.  The world is changing.

How much money have you spent on gadgets?

No, seriously, have you ever totaled it up?  If you’re like me, you’ve spent a bundle.  And, I’m not even an “early adopter” or an Apple fanboy who has to replace his iPhone with the latest version every time a new feature is added, either.  Does all that feel like a waste of money to you sometimes?  Well, what if you’d invested it, instead?
What if, instead of buying the latest Apple, or whatever brand, gear, you had invested in stock in the company?  Imagine, if you’d taken the price of a first generation iPod and bought Apple stock, instead.  Or a G4 or a MacBook or whatever.  How much money would that be now?

Well, wonder no more, because Kyle Conroy has done the work for  you.
He asks the question; What if I had bought Apple Stock instead?  He charts how much money he’d have now if he’d invested the purchase price of the latest Apple gear in Apple stock instead, from the release date until now.
The results may make your buyer’s remorse just a little worse.

One of the many problems I’ve always had with the majority of science-fiction is space.

No, not outer space, but, rather, the space they use on spaceships and the like.  Something like the [amazon_link id=”1451621299″ target=”_blank” ]U.S.S. Enterprise[/amazon_link] is fantastic and fun, but, frankly wholly unrealistic in their use of available space on a star ship.  Those high ceilings and vast gardens are wonderful, but, really, they add so much mass to a deep space vessel  that I have to wonder if they’re really a good use of materials, not to mention the fuel to move it all and maintain it.
Even [amazon_link id=”B0036EH3UC” target=”_blank” ]Battlestar Galactica[/amazon_link] seems to have incredibly high ceilings for a military vessel.  I mean, compare it to, say, an aircraft carrier, or, perhaps more reasonably, a submarine.  Granted, modern submarines have vastly more space available to them than their predecessors from World War II, but, still, space is at a premium.

In our only actual space installation, the International Space Station, space is certainly at a premium.  Granted, it’s not something that we still seem to be spending a lot of money on to improve or expand or even replace or duplicate, but it is the only real off-planet installation we currently have.  As such, it’s all we have to use as a guide for how future space craft or space stations might use their space.  So, if you’re a science-fiction writer, a future or hopeful science-fiction writer, or even just a fan, you owe it to yourself to check out this tour of the ISS.  Trust me on this, it will be an “eye opener” for many people seeing it for the first time.

Also?  I think it’s incredibly cool that people are living in space, even in cramped quarters, even for relatively short periods of time.
We live in the future.

No, not your personal name, network names!

Yeah, since I’ve been thinking about computer security a little in this new year and new decade, I’ve noticed a slightly disturbing trend.  Spammers have been working at redirecting you to compromised domains.  One way they do it is something called DNS cache poisoning.  Another is straight-up DNS hijacking.

Okay, let me back up a second.  For my slightly less-technical readers, DNS stands for Domain Name System.  That’s the system of servers that translates website names, like “www.google.com”, into addresses that your computer understands and can connect you to via a browser.  It’s how you found my blog, though you may not have even realized it.
DNS Hijacking is usually accomplished via a “rouge” server, which is a server setup by spammers to publish bad information.  The more usual method, I think, and more insidious, is DNS cache poisoning.  With that method, spammers trick good, valid DNS servers into updating their records with bad information.  Giving them poisonous information, if you will.

So, now, back to the hard-core server admins.  Last week I was reminding everyone that the start of a new year is a great time to change passwords, but it’s also a great time to check on other security issues, like your DNS.  Luckily, Michael Kassner over at TechRepublic has written a blog post titled Test your DNS servers for spoofability.  It’s worth a read and worth running through.  Maybe even making it a regular practice, to see if your DNS has been compromised.

Oh, and if you all want to read more about DNS, and how to implement it, there’s a great book from O’Reilly titled [amazon_link id=”0596100574″ target=”_blank” ]DNS and BIND[/amazon_link] that’s well worth owning.  Trust me.

Advice from your Uncle Jim:
"There's more than one way to do it"
   --Unofficial PERL Coder's Motto

Yeah, yeah, happy New Year to you you, too, now, go change your passwords.

No, seriously, change your passwords.  Think about how long it’s been since  you either setup that account or changed the password on it.  Now, consider that there have been some significant security breaches in the past year, including the issues at Gawker and their family of popular websites, and think about how many places you’ve used that same password.  It’s your favorite one, right?  The one you use for all your accounts, because it’s so, so easy to remember?  Guess what, it’s also probably easy to crack and is probably in a database on some hacker/cracker website right now matched up with the e-mail address you used, too.  How long will it be, do you suppose, before someone gets into all your accounts?

Right.
So, go change your passwords.
Not sure how to pick a good one?  Well, if you trust the U.S. Government for security, you can go to their Computer Emergency Readiness Team (aka US-CERT) for advice on choosing a secure password.  If you’re like me, though, you categorically do NOT trust a government agency for your personal security, in which case I recommend that you check out premier security expert Bruce Schneier’s advice for picking a secure password.

I’ll offer two bits of advice on the topic.
First, if any system lets you, choose a password that includes numbers and special characters, not just letters.  The example I always use is “@2brutus”  And, yes, that means I will NEVER again use that as a password. *sigh*  I like to substitute numbers for letters which resemble them, like the number one instead of the letter L or the letter I.  In the example, I’ve taken a  whole word out “et” and substituted the “at” symbol, or “@”.
Secondly, try to use something that is not a single word, but a phrase.  Again, in the example, I took my bastardization of “et tu brute”, which I remembered as “et tu brutus” and mashed it up a bit.  I have known people who use short sentences, however.  One guy I worked with occasionally used lines from Lewis Carroll’s [amazon_link id=”0810911507″ target=”_blank” ]Jaberwocky[/amazon_link], which adds the extra security of words that will most likely never be found in any standard dictionary of any language.

So, trust me on this, if you haven’t done it, start the new year right and change your passwords.

Advice from your Uncle Jim:
"Not a shred of evidence exists in favor of the idea that life is serious."

It’s not quite the “birthday” of the mouse, but…

Today is the 42nd anniversary of the first time a mouse made its commercial debut, though the patent was actually granted just a few weeks earlier on November 17th. That’s right, the mouse, that marvel of modern technology that most of us use daily is just a little older than I am. Invented by Douglas C. Engelbart and the group of 17 researchers working with him in the Augmentation Research Center at Stanford Research Institute in Menlo Park, CA, the original mouse was little more than a square, wooden box, but the little device would change the world. Engelbart showed how the mouse could let a user jump from text on one part of the screen randomly to another section without having to scroll through the text inbetween. Doesn’t sound too revolutionary to us today, does it? But, think about how you navigated to this page to read this little blurb, then try to imagine doing it without a mouse. Or, imagine trying to use Photoshop or any other graphic design program for that matter without the point-click-and-drag of a computer mouse. Yeah, pretty much everything cool you can do on a computer these days involves a mouse or similar pointer. Now, of course, to me, that’s the real genius of an invention like the mouse; it seems so obvious that we wonder why we didn’t think of it sooner!

So, happy demo day, little guy. Thanks for giving me a job and us a way to waste time at work.