Protect your data – by destroying it!

Boy that sounds interesting doesn’t it? But what does that mean?

As computers age and are replaced, they might find their way to a dumpster, or given to a non-profit organization who refurbishes them and resells them, or they may be given to a computer recycler who is supposed to dispose of the computer in an environmentally friendly manner.

The problem with all of these scenarios is that you don’t actually know what will become of your data.

Let’s assume for a moment that you are an attorney and you replace your computer. You toss the old computer, but you took measures to protect the data on your hard drive first, such as, maybe reinstalling a fresh OS on it, ore deleting all your personal files, or even performing a format operation on the hard drive. Someone who targets people in your line of work may be watching the dumpsters and upon finding the discarded PC, could pull the drive out and use recovery software that is available to restore some, if not all of your previous data! That’s right, even if you DELETE IT, reinstall the operating system, or format it, the chances are very good that data can be retrieved off of your drive. EVEN IF THE DRIVE HAS CRASHED, chances are, some data can be recovered by a professional or anyone serious enough to attempt it.

The same holds true for PC recyclers…  See a previous blog entry here with a video that outlines what becomes of many computers.

So what is a person or business to do in order to protect themselves, their data and the data of their customers that may be on an old PC? Your options are to trust your computer service / network support technicians to do the job for you, which we will often do here at Homeland Secure IT, where we take your old PC and perform a “DOD wipe” that writes zeros and ones to every sector on the drive multiple times over, rendering it virtually unrecoverable, or sometimes we damage a hard drive beyond recovery using physical means.  Another option is to simply remove the hard drive and shelve it, while discarding the rest of the computer.

There is an alternative though. There are professional data destruction service providers who will go to your location, remove your hard drive for you, and SHRED the drive, turning it into data confetti! This is the widely accepted standard for protecting data on old drives. You cannot recover bits of data from bits of shredded metal.

A benefit of using data destruction professionals is that they can provide you with the proper documentation that relieves you from all liability, as you have done everything in your power to protect important data. You can also witness the destruction first-hand if you do desire.

ShredDesk Inc. of Greenville is one such business that can provide this service and I highly recommend them!  Brent offers fast response and reasonable rates! He will personally visit your location, remove the hard drive for you, grind it to shreds and provide you with a Certificate of Destruction! Brent covers the entire Upstate and even has clients outside this area that he travels to.

If you are an IT worker, you can stockpile drives as you upgrade machines and call Brent when you have a stack of them to make it very cost affective and simple!

For more information about data destruction, data protection using hard drive backups, and network protection / security using firewalls, anti-virus and more, please call 864.990.4748 or email info@homelandsecureit.com

Microsoft’s latest version of Office 2011 is due out in October of 2011. It features many improvements over previous versions and comes in the following flavors:

Microsoft Office for Mac Home and Student 2011 includes Word for Mac, PowerPoint for Mac, Excel for Mac and Messenger for Mac. It will retail for $119  for a single install and $149 for the “Family Pack” giving you up to 3 installs. The Home and Student edition includes the core productivity applications that Mac users want and need.

Microsoft Office for Mac Home and Business 2011 includes Word for Mac, PowerPoint for Mac, Excel for Mac, Outlook for Mac and Messenger for Mac. It will retail for $199 for a single install and $249 for the “Multi-Pack” which allows two installs. This version sports all features of the Home and Student version with the addition of Microsoft Outlook for Mac.

Microsoft Office for Mac Academic 2010 includes Word for Mac, PowerPoint for Mac, Excel for Mac, Outlook for Mac and Messenger for Mac. It will retail for $99 and be available direct from Microsoft and authorized academic stores.

Buy  Microsoft Office 2008 for Mac today and upgrade to Office 2011 at no additional cost!

If you require additional information about Microsoft Office for Mac or Windows, please email info@homelandsecureit.com or call 864.990-4748. Homeland Secure IT offers computer and network support in the Greenville / Upstate area, as well as national sales of Microsoft products!

Let me preface this post with the fact that I had never heard of The Warehouse Theatre until my family participated in the “Google on Main” event earlier this year. After that event, there was a follow-up which took place at The Warehouse and that was the first time I set foot in the facility.

Since then, we have been seeing lots of discussions on various social media sources about plays and events at that venue and decided we just had to check it out, so I purchased tickets on the phone last week for “The Clean House”… To make this even more interesting, I scored a “Social Media Press Pass” which let me in for free…  What on earth was The Warehouse Theatre thinking when they gave MEa press pass? haha  I think it must be because I quickly jumped on the band wagon when Aaron Von Frank (@AaronVonFrank) said he and Paul would dress up as French Maids and clean the home of one lucky attendee if all the shows sold out!  

All that aside, I took my wife Pamela, 17 year old daughter Megan and 15 year old son Brett this afternoon’s performance of “The Clean House”.

Having little exposure to community theatre, I must admit that when I walked in the doors today I was not exactly sure what to expect. I’ve been to many plays and musical productions, paying lots of money for great seats in world reknown theatres, and to be honest, I had braced myself for disappointment. I assumed that I would be watching a production similar to a high school play, with lousy lighting, poor audio, a spartan set and worse, actors straight out of the high school drama department.

Boy was I wrong! The audio was perfect, excellent sound quality, not a missed cue. The lighting was outstanding, including a video backdrop with colored background and text/graphics that were perfectly synchronized with the actors – if there was a mistake made, I sure didn’t witness it!

The set itself was a work of art and fit perfectly with the lifestyle of Lane (Stark white, sterile, with modern furnishings), however, the biggest thing I was wrong about was the quality of these actors!

I am not familiar with the work of the playwright, Sarah Ruhl, but these actors managed to portray characters that I believe we all can relate to and managed to capture our hearts in doing so. Many Broadway productions I’ve seen could have benefited from the expertise of this cast! I saw nothing but true seasoned professionals!

Without giving away too much, this play is funny…  And the timing of the cast was impeccable.  The lead character, Matilda (played by Lynne Junker) is a hired on by Lane (Debra Capps) as a house keeper, but she hates cleaning… Matilda has us laughing from the start. Virginia (played by Elizabeth Finley) the OCD sister of Lane feels moved to help the “depressed” Matilda by cleaning for her.

While cleaning, Virginia discovers the undergarments of someone other than Lane and that leads to the assumption that Lane’s husband Charles is having an affair. As it turns out, it is more than an affair, and we are taken on an interesting ride through what could be considered unbelievable if you have never been involved in something so ludacris in real life. My wife says she can totally relate with every character as the twist and turns unfold.

The play takes you full circle through relationships and the drama that goes with them sometimes. As I mentioned, it is very lighthearted, so do go prepared to laugh at the tragic story. (It is really a love story, but I’ll let you discover this for yourself)…

I feel I must appologize to these wonderful actors and The Warehouse Theatre for being so cynical about what Greenville had to offer in The Arts. I have been missing out on a lot and I am glad to have discovered this source of entertainment and enlightenment for our family.  For a fraction of the cost of an evening at The Peace Center, you can rest assured we will be visiting this venue frequently! 

The next show at The Warehouse Theatre is “The Rocky Horror Show”, a personal favorite that is coming up in October!!!! Hope to see you there!

Raimund Genes, Trend Micro’s CTO explains how a computer becomes infected. It might not be what you expected.

Homeland Secure IT Alert

Homeland Secure IT Alert #3 for Thursday, August 26, 2010

Not to be outdone by the Apple Mac OS X security issues, Microsoft has a few new issues as well. This time regarding DLL handling.

What follows is the original posting from US-CERT:

—

National Cyber Alert System

Technical Cyber Security Alert TA10-238A

Microsoft Windows Insecurely Loads Dynamic Libraries

Original release date: August 26, 2010
Last revised: –
Source: US-CERT

Systems Affected

Any application running on the Microsoft Windows platform that
uses dynamically linked libraries (DLLs) may be affected. Whether
or not an application is vulnerable depends on how it
specifically loads a DLL. Please see the Vendor Information
section of Vulnerability Note VU#707943 for information about
specific vendors.

Overview

Due to the way Microsoft Windows loads dynamically linked libraries
(DLLs), an application may load an attacker-supplied DLL instead of
the legitimate one, resulting in the execution of arbitrary code.

I. Description

Microsoft Windows supports dynamically linked libraries (DLLs) that
are loaded when needed by an application. DLLs are typically loaded
when the application is first started; however DLLs may be loaded
and unloaded while the application is running. An application can
request a DLL file in a variety of ways, and Windows uses several
different search algorithms to find DLL files. The interaction
between the application and Windows can result in a DLL file being
loaded from the current working directory of the application,
instead of the Windows system directory or the directory where the
application is installed.

The current working directory could be the desktop, a removable
storage device such as a USB key, a Windows file share, or a WebDAV
location. When a file associated with an application is opened, a
DLL in the same directory as the file may be loaded. Although an
attacker may not have permission to write to the Windows system or
application directories, the attacker may be able to write a DLL to
a directory used to store files, or the attacker could provide
their own directory.

Attacks against this type of vulnerability have been referred to as
“binary planting.” Please see Vulnerability Note VU#707943 and
Microsoft Security Advisory 2269637 for more information.

II. Impact

By placing a DLL with the correct name (and possibly the relative
directory path) in the current working directory, an attacker could
execute arbitrary code with the privileges of the application that
loads the DLL.

III. Solution

Individual applications that run on the Windows platform may
require patches or updates. Microsoft Knowledge Base article
KB2264107 describes an update that provides a registry key that can
prevent Windows from searching the current working directory for
DLL files.

Information about specific solutions for different vendors, general
mitigation techniques, and secure ways for applications to load
DLLs can be found in the Vendor Information and Solution sections
of Vulnerability Note VU#707943.

IV. References

* Vulnerability Note VU#707943 -

* Microsoft Security Advisory (2269637) -

* A new CWDIllegalInDllSearch registry entry is available to control
the DLL search path algorithm -

____________________________________________________________________

The most recent version of this document can be found at:
____________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send
email to with “TA10-238A Feedback VU#707943″ in
the subject.
____________________________________________________________________

For instructions on subscribing to or unsubscribing from this
mailing list, visit .
____________________________________________________________________

Produced 2010 by US-CERT, a government organization.

Terms of use:
____________________________________________________________________

Revision History

August 26, 2010: Initial release

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBTHbPuj6pPKYJORa3AQI0Rwf+JjLbBdWxKa+8pzCefxhs+maIjzihg/vN
ZNF90uuFgMAdIrTD7+Qlv6TUc3ep/O28Dg11K8rXaOfxeyPsItMwpbz7vrpoUC5W
qvu6pYQnmhW/egryPPC8cwFecuDaTNNWDShwQ8oULXnp2mfj9q3LUvVOvLXaiwXs
rivmLthvhCjWBYpYFBb9yHjHOcQd4JQ0LS4A4BRzXGKTTgMnRvawPeHFQvsMlR0M
plrIJ4Lht3eOis97Rot9BIIcYytM74ctz6TwCwOz5JPTA1ncikEzoLhaKCQ2egpq
GmyjcQLo83JWRxDkBE9EkBhkpOjyhsvpVLZoJrqpkwKtJMUVeLcBBw==
=M/vJ
—–END PGP SIGNATURE—–

—

If you have questions or need assistance with this issue, please call 864.990.4748 or email info@homelandsecureit.com

Homeland Secure IT Alert

Secure IT Alert #2 for Thursday, August 26 2010

More bad news for Mac owners. PLEASE update your systems. We are seeing the number of Mac and *nix exploits ramp up at an alarming rate. Many people have found rootkits were installed on their systems for no telling how long before they were discovered.

The following information was provided courtesy of WatchGuard. Fantastic firewall devices at reasonable prices! If you should be interested, we are a partner with WatchGuard and offer their full line-up.

 

Malicious Documents and Images Threaten OS X

Severity: Medium

24 August, 2010

Summary:

• These vulnerabilities affect: All current versions of OS X 10.5.x (Leopard) and OS X 10.6.x (Snow Leopard)
• How an attacker exploits them: Multiple vectors of attack, including enticing your users into downloading and viewing various documents or images
• Impact: Various results; in the worst case, an attacker executes code on your user’s computer
• What to do: OS X administrators should download, test and install Security Update 2010-005 as soon as possible, or let Apple’s Software updater do it for you.

Exposure:

Today, Apple released a security update to fix vulnerabilities in all current versions of OS X. The update fixes thirteen (number based on CVE-IDs) security issues in seven components that ship as part of OS X, including PHP, CoreGraphics, and ClamAV. Some of the fixed vulnerabilities include:

• CoreGraphics Buffer Overflow Vulnerability. CoreGraphics is an OS X component that helps output graphics to your display (or printer). CoreGraphics suffers from a heap buffer overflow vulnerability involving the way it handles PDF files. If an attacker can get a victim to view a specially crafted PDF document (perhaps hosted on a malicious web site), he could exploit this flaw to either crash an application or to execute attack code on the victim’s computer. By default, the attacker would only execute code with that user’s privileges.
• ATF Buffer Overflow Vulnerability. The Apple Type Service (ATS) helps OS X machines handle fonts. ATS suffers from a buffer overflow vulnerability having to do with the way it handles embedded fonts. By tricking one of your users into downloading and viewing a malicious document containing a specially crafted font, an attacker can exploit this flaw to execute code on that user’s computer. By default, the attacker would only execute code with that user’s privileges. 
• Multiple PHP Vulnerabilities. PHP is a general-purpose scripting language primarily used to create dynamic web applications, which ships with OS X. Apple’s update fixes several vulnerabilities found in PHP 5.3.1. However, Apple only describes one of the PHP vulnerabilities in any detail. The vulnerability involves a buffer overflow flaw within one of PHP’s image handling function libraries. By enticing one of your OS X users into viewing a specially crafted PNG image (perhaps hosted on a malicious web site), an attacker could exploit this flaw to execute code on that user’s computer, with that user’s privileges.

Apple’s alert also describes other vulnerabilities, including some Denial of Service (DoS) flaws, information disclosure issues, and a few more code executions flaws. Components patched by this security update include:

ATS	CFNetwork
ClamAV	CoreGraphics
libsecurity	PHP
Samba

Please refer to Apple’s OS X 10.5.x and 10.6.x alert for more details.

Solution Path:

Apple has released OS X Security Update 2010-004 and OS X 10.6.4 to fix these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.

• Security Update 2010-005 (Leopard)
• Security Update 2010-005 (Leopard Server)
• Security Update 2010-005 (Snow Leopard)
• Security Update 2010-005 (Snow Leopard Server)

Note: If you have trouble figuring out which of these patches corresponds to your version of OS X, we recommend that you let OS X’s Software Update utility pick the correct updates for you automatically.

For All Users:

These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.

Status:

Apple has released updates to fix this flaw.

References:

• August 2010 OS X 10.5x and 10.6.x Security Update

This alert was researched and written by Corey Nachreiner, CISSP.

---

Did this alert help you? How could we improve it?
Let us know at lsseditor@watchguard.com.

For past alerts, log into the LiveSecurity Archive.

Jargon defined in the LiveSecurity Online Glossary.

—

If you require assistance please call us at 864.990.4748 or email info@homelandsecureit.com - we offer computer & network support to Greenville / Upstate, SC

Homeland Secure IT Alert for Thursday, August 26th 2010

I know it seems like it never ends… Adobe Reader, Adobe Acrobat, Adobe Flash, Adobe Air, Java, Windows, Mac, one update and patch after another following these security announcements….  

The vulnerability de jour is brought to you by Adobe, and it affects Shockwave player on Macintosh OSX and Windows platforms. The short and skinny is – update today, don’t delay….  What follows is information sent out courtesy of WatchGuard who makes a fantastic line of Firewalls, Network Security and Unified Threat Management Appliances for every application. We are proud to partner with WatchGuard and offer their products.

Adobe Shockwave Update Corrects 20 Security Flaws

Severity: Medium

25 August, 2010

Summary:

• This vulnerability affects: Adobe Shockwave Player 11.5.7.609 and earlier, running on Windows and Macintosh computers
• How an attacker exploits it: By enticing your users into visiting a website containing malicious Shockwave content
• Impact: An attacker can execute code on your computer, potentially gaining control of it
• What to do: If you allow the use of Shockwave in your network, you should download and deploy the latest version (11.5.8.612) of Adobe Shockwave Player as soon as possible.

Exposure:

Adobe Shockwave Player displays interactive, animated web content and movies called Shockwave. According to Adobe, the Shockwave Player is installed on some 450 million PCs.

In a security bulletin released late Tuesday, Adobe warned of twenty critical vulnerabilities that affect Adobe Shockwave Player 11.5.7.609 for Windows and Macintosh (as well as all earlier versions). Adobe’s bulletin doesn’t describe the flaws in much technical detail. It only describes the nature and basic impact of each flaw. For the most part, the flaws consist of unspecified memory corruption vulnerabilities. Though these flaws differ technically, most of them share the same general scope and impact. If an attacker can entice one of your users into visiting a website containing some sort of malicious Shockwave content, he could exploit many of these vulnerabilities to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PC. Adobe’s alert doesn’t describe what type of Shockwave content triggers these various flaws. However, other researchers’ alerts have disclosed that malicious Shockwave (.SWF) and Director (.DCR and .DIR) files can trigger these vulnerabilities.

If you use Adobe Shockwave in your network, we recommend you download and deploy the latest version as soon as you can.

Solution Path:

Adobe has released a new version of Shockwave Player, version 11.5.8.612. If you use Adobe Flash in your network, we recommend you download and deploy this updated player as soon as possible.

For All WatchGuard Users:

Some of WatchGuard’s Firebox models allow you to prevent your users from accessing Shockwave content (.SWF, .DIR, and .DCR) via the web (HTTP) or email (SMTP, POP3). If you like, you can temporarily mitigate the risk of this vulnerability by blocking .SWF, .DIR, and .DCR files using your Firebox’s proxy services. That said, many websites rely on Shockwave for interactive content, and blocking it could prevent these sites from working properly.

—

If you require assistance in in updating the Shockwave player, or specific instructions for applying the WatchGuard content blocks above, please call us at 864.990-4748 or email info@homelandsecureit.com – We provide network and computer support to Greenville / Upstate businesses and individuals! We offer sales of WatchGuard Firewalls and UTMs nationwide.

Our friends at Trend Micro Labs are watching out for you, even if you opt to not purchase their incredible anti-virus software!

If you are using Internet Explorer 6, 7, or 8 you could fall victim to what is known as  ”zero day exploit”, which is simply a hole that is found by the bad guys and a means for taking advantage of that security flaw is devised and deployed before the good guys can prepare for it.

The easiest application to exploit is Microsoft IE, because it is the most popular browser currently, and we just can’t stop clicking on links. We are addicted to clicking every link we find, and should one of those be a malicious site, we run the risk of becoming a victim if we do not have the latest patches, and sometimes with these zero day exploits, there IS NO PATCH.

Browser Guard 2010 from Trend Micro may help prevent your IE from leading you into trouble. As mentioned, it is a free download and works with IE 6, 7 and 8. If you are using an x64 (64 bit) system, you are out of luck though.

The following is extracted from their site:

Trend Micro Browser Guard is an easy to use browser plug-in, which prevents known and unknown web threats. Zero-day attacks such as Aurora and Hydraq can be proactively blocked by Browser Guard, which detects and prevents behavior associated with these types of threats.

Cybercriminals often use malicious JavaScript inserted into web pages, where attacks can take place silently, without any visible effect. Browser Guard also protects you from such attacks by analyzing and subsequently blocking malicious JavaScript. For the most advanced and efficient detection, Browser Guard communicates with the Trend Micro Smart Protection Network, bringing you the latest protection when you surf the web.

Key Benefits

• Protects against zero day exploits
• Detects buffer-overflow and heap-spray attacks
• Protects against execution of shell code
• Analyzes and protects against malicious JavaScript
• Connects with Trend Micro Smart Protection Network to maximize detections

CLICK HERE to go to the Trend Micro Browser Guard page.

If you are using Chrome, Firefox or another alternative browser, you can still become a victim, just not as easily due to the fact that these browsers are not being targeted as frequently.

If you have questions or require assistance, please call 864-990-4748 or email info@homelandsecureit.com – We offer affordable and fast virus removal and cleanup in Greenville / Upstate SC (If you suspect you have a virus, click here, then select the free online scan)

This morning I was having a discussion with a potential client and we were talking about the “Homeland Secure IT” name, the individual mentioned that they understood the play on words, however they were simply not sure how to take “IT”, because they thought of “IT” only in the terms of “Information Technology”…

I explained that the “IT” in our case is an all encompassing catch-all term that covers just about anything you plug into the wall. We sell, service, repair, support a wide range of technologies, not just a computer, server or network, but VoIP systems, CCTV and network security camera systems, firewall appliances, anti-virus software and software in general.

So basically, whatever IT is, we can help you with IT!

I am unsure of a way to indicate everything we work with, but suffice it to say, it is not limited to just a notebook computer fix, or a simple virus cleanup. While we DO those things, we also deploy Blackberry Enterprise Server so your mobile users can stay connected. We help integrate wireless devices like Androids, iPads and more into your Microsoft Exchange. We configure VPNs that allow a mobile workforce or a branch office to connect to your data as if they were physically in your office. We design and deploy Voice over IP phone systems. We offer biometric and card swipe time clocks.

Again, if it plugs into your network, or connects wirelessly, or you WANT it to, we can help. Give us a call at 864.990.4748 or email info@homelandsecureit.com to discuss your unique needs! We serve the Greenville & Upstate SC area!

Web Enabled Thermostats: A not-so-new technology is becoming mainstream due to the desire to save money and be “green”.

If you have been looking to purchase a new HVAC system for your home or business, you may have been given the option to include a thermostat that enables you to view statistics & make changes to the settings using a web browser or an app on your phone. The price ranges from a round $100.oo to as much as $500.oo at the time you purchase a new system, and you promised that it will pay for itself by allowing you to set schedules to reduce the costs of operating your system during times you are away from the home/business.

Some utility companies, such as UTX in Texas have plans you can sign up for that will enable you to get a FREE web enabled thermostat, and I believe you only pay around $75.oo for the installation. Ultra good deal in my opinion.

But what about those of us with older systems? Fortunately, the majority of web enabled thermostat manufacturers have designed their units with us in mind. Instead of targeting the new HVAC market, they have built devices that can be used with any system, whether it is a heat pump, or an oil fired unit, there is a model for you.

The benefits are as mentioned before… Ability to control your system from a web browser, ability to control your system from a phone with either a web browser or an app loaded on it for that thermostat. Some thermostats feature the ability to control other devices, such as lighting, and some have the ability to sense a contact closure. You can see a graph of system usage and override scheduled events, as well as easily SEE the schedules, rather than paging through one day at a time as you do on older programmable thermostats. Some units feature alerts, should your system not cool or heat properly, which would be perfect for those who have unattended / vacation properties.

What about security? Can someone “hack” my home? Sure! Anything that is accessible via the internet could potentially be exploited by attackers, however, these devices are currently low-profile making them an unlikely target. Most of the manufacturers claim security through encryption of the data stream.

Where do you get one of these? Online vendors have a large selection of web thermostats, and your HVAC vendor probably has their favorite. Some quality brands are Ecobee, Control By Web, Schlage / Trane, Proliphix, BAYweb, among others. Which model is right for you should be based upon exactly what features you require. For instance, some have a Wi-Fi option to eliminate the CAT-V cable run.

Can I really recoup my investment? That remains to be seen. I am sure a $150.oo unit could pay for itself in a year or more if you are replacing a non-programmable thermostat, but for some of the higher end products, I’m thinking that realistically you are looking at a couple years… Your mileage may vary.

If you have any question about these, please email info@homelandsecureit.com, call 864-990-4748×201 or respond here! If you have one, tell us what you like best about them.