When selecting a backup solution, you may be considering one of the following:

LTO, DLT, DAT Tape – The de facto standard in backup media for business and enterprise. Though it is growing a little long in the tooth, the format has proven itself to be reliable and affordable when you consider the lifetime of the drive and the media. These are available in a variety of flavors, from SCSI, to SATA, internal and external. And for those needing massive storage and speed, there are enormous auto-loaders such as 96 slot HP LTO 5 fiber channel systems.

Iomega REV removable cartridge systems – Outdated, no longer sold or supported by Iomega. (You can still buy media)

Portable hard drives – While these seem attractive because they are cheap and available at every office supply house in town, the reliability of these devices is not idea for mission critical solutions. The constant plugging and unplugging of USB cables can wear connectors out prematurely and there is the slight possibility that a server can be damaged by static when plugging in a drive. Most IT people feel this is a better solution than no solution at all.

Remote Backup or In-The-Cloud backup – We offer Servosity Online Backup and feel it is a great addition to any existing hardware backup system you may have, and could serve as your primary backup if so desired. These are affordable solutions that require very little hands-on time.

Network based disk storage – These are awesome for speed, and convenience, but they generally remain on site and in the event of a catastrophic disaster such as fire, flood, or even theft, you could be left with no backup. This falls under the “much better than nothing” category.

Flash drives and other non-volatile storage media, including CD & DVD – Again, this better than nothing and surely works for small amounts of data, but longevity may be in question. CDs and DVDs have a lifespan after written to, usually of only a few years, making long term archival use impossible. Flash drives are great to make a quick backup, but there are occurrences of people losing data on one from high powered RF devices erasing them. Probably not a solution for most businesses.

A plethora of other technologies exist, but one that has been gaining momentum in the business and enterprise market is RDX.

RDX, or Removable Disk Technology is based around a docking station that accepts an RDX cartridge. The cartridge encases and protects a hard drive. RDX cartridges come in many sizes, whether you need 160GB or 1.5TB, there is bound to be one that fits your data needs.

What makes RDX different from a typical portable or removable drives? It is a “hardened” solution that encloses the hard drive and enables it to take a drop of up to 1 meter. These systems also offer protection from static discharge. A typical RDX can move upwards of a 100GB an hour. If you outgrow the the original size cartridge, you can begin replacing them with larger capacity as the dock is backwards and forwards compatible with any other RDX cartridge.

RDX is a standard that allows you to purchase cartridges from any manufacture to use in your system. It also offers a shelf life of up to 30 years, allowing you to archive your data and know that if the IRS audits you, you can access it.

No need to upgrade your current backup software in most cases when switching to RDX as the technology is already supported in most backup applications such as Symantec Backup Exec!

If you are looking for a backup solution, whether it is your first, or an upgrade of a current system, then you may wish to give RDX a close look. Call us at 864.990.4748 or email info@homelandsecureit.com. We offer RDX products from HP, Imation, Lenovo, and Quantum to name a few. We offer a free evaluation in Greenville and the Upstate of South Carolina.

I hate to keep beating this dead horse, but a dear friend called this morning as I was on my way in to the office, telling how his notebook computer had experienced a totally depleted battery over the weekend and that when he tried to bring it back up, he got the dreaded blue screen of death… This was followed by lots of time attempting to get the machine to run, and then a restless / sleepless night worrying about lost productivity, unrecoverable data, and expense involved.

I told him not to worry because somehow, some way, we will recover his data and get him back online. Of course, he didn’t mention that no backup existed until near the end of the conversation… Hopefully this story will have a happy ending…

What are you doing for a disaster recovery plan? Sure you are backing up your desktops and servers, but what about those notebooks? We offer a free trial of Servosity Online Backup…

With Servosity Online Backup you will be able to sleep at night knowing your data is protected, even on mobile computers which may never see the main office. Your data is encrypted and uploaded to the Servosity secure remote storage server. In the event of a disaster, individual files, folders, or an entire system drive can be restored.

Have important files that change throughout the day? Servosity also offers CONTINUOUS backup protection – important files are backed up as they are changed on your system. All of this takes place automatically.

Servosity works with Microsoft Windows, Apple Mac OSX, Linux and other *nix based operating systems. Don’t take a chance, try out Servosity TODAY! For FREE!

Homeland Secure IT offers many backup solutions and one is just right for your application! Tape, Backup-2-Disk, NAS/SANs, Autoloaders and Jukeboxes… Email info@homelandsecureit.com or call 864.990.4748 for more information.

It is a holiday, I’m not going to blog today!  Instead, let me point you towards something Coolio (Sorry, that’s another hip-hop artist all together)…

Snoop Dogg has is now joining forces to fight cyber crime: HACK IS WACK 

If you upload your own video, please let me know! I want to see it!

Hope everyone is enjoying their Labor Day off!

Lee Brookshire of Hitachi/HEDUS corporation in Greenville and Allen Vailliencourt of Find Great People, also in Greenville are our winners!

Congratulations to both of them, as they have won Trend Micro Internet Security 2010 anti-virus in our little giveaway…

Trend Micro Internet Security 2010 is designed for home and small business users and offers protection against viruses, spyware, unauthorized changes to applications, as well as offering outstanding email protection from spam and malicious emails and Web monitoring too!

The $49.99 retail package will cover up to 3 computers.

If you would like to purchase Trend Micro products, including Internet Security 2010, Internet Security Pro, Worry-Free Business Security or Enterprise packages like the Enterprise Security Suite, etc, or would like additional information, please email info@homelandsecureit.com or call 864.990.4748 – We offer computer security service and support in Greenville / Upstate SC and national sales!

Protect your data – by destroying it!

Boy that sounds interesting doesn’t it? But what does that mean?

As computers age and are replaced, they might find their way to a dumpster, or given to a non-profit organization who refurbishes them and resells them, or they may be given to a computer recycler who is supposed to dispose of the computer in an environmentally friendly manner.

The problem with all of these scenarios is that you don’t actually know what will become of your data.

Let’s assume for a moment that you are an attorney and you replace your computer. You toss the old computer, but you took measures to protect the data on your hard drive first, such as, maybe reinstalling a fresh OS on it, ore deleting all your personal files, or even performing a format operation on the hard drive. Someone who targets people in your line of work may be watching the dumpsters and upon finding the discarded PC, could pull the drive out and use recovery software that is available to restore some, if not all of your previous data! That’s right, even if you DELETE IT, reinstall the operating system, or format it, the chances are very good that data can be retrieved off of your drive. EVEN IF THE DRIVE HAS CRASHED, chances are, some data can be recovered by a professional or anyone serious enough to attempt it.

The same holds true for PC recyclers…  See a previous blog entry here with a video that outlines what becomes of many computers.

So what is a person or business to do in order to protect themselves, their data and the data of their customers that may be on an old PC? Your options are to trust your computer service / network support technicians to do the job for you, which we will often do here at Homeland Secure IT, where we take your old PC and perform a “DOD wipe” that writes zeros and ones to every sector on the drive multiple times over, rendering it virtually unrecoverable, or sometimes we damage a hard drive beyond recovery using physical means.  Another option is to simply remove the hard drive and shelve it, while discarding the rest of the computer.

There is an alternative though. There are professional data destruction service providers who will go to your location, remove your hard drive for you, and SHRED the drive, turning it into data confetti! This is the widely accepted standard for protecting data on old drives. You cannot recover bits of data from bits of shredded metal.

A benefit of using data destruction professionals is that they can provide you with the proper documentation that relieves you from all liability, as you have done everything in your power to protect important data. You can also witness the destruction first-hand if you do desire.

ShredDesk Inc. of Greenville is one such business that can provide this service and I highly recommend them!  Brent offers fast response and reasonable rates! He will personally visit your location, remove the hard drive for you, grind it to shreds and provide you with a Certificate of Destruction! Brent covers the entire Upstate and even has clients outside this area that he travels to.

If you are an IT worker, you can stockpile drives as you upgrade machines and call Brent when you have a stack of them to make it very cost affective and simple!

For more information about data destruction, data protection using hard drive backups, and network protection / security using firewalls, anti-virus and more, please call 864.990.4748 or email info@homelandsecureit.com

Raimund Genes, Trend Micro’s CTO explains how a computer becomes infected. It might not be what you expected.

Homeland Secure IT Alert

Homeland Secure IT Alert #3 for Thursday, August 26, 2010

Not to be outdone by the Apple Mac OS X security issues, Microsoft has a few new issues as well. This time regarding DLL handling.

What follows is the original posting from US-CERT:

—

National Cyber Alert System

Technical Cyber Security Alert TA10-238A

Microsoft Windows Insecurely Loads Dynamic Libraries

Original release date: August 26, 2010
Last revised: –
Source: US-CERT

Systems Affected

Any application running on the Microsoft Windows platform that
uses dynamically linked libraries (DLLs) may be affected. Whether
or not an application is vulnerable depends on how it
specifically loads a DLL. Please see the Vendor Information
section of Vulnerability Note VU#707943 for information about
specific vendors.

Overview

Due to the way Microsoft Windows loads dynamically linked libraries
(DLLs), an application may load an attacker-supplied DLL instead of
the legitimate one, resulting in the execution of arbitrary code.

I. Description

Microsoft Windows supports dynamically linked libraries (DLLs) that
are loaded when needed by an application. DLLs are typically loaded
when the application is first started; however DLLs may be loaded
and unloaded while the application is running. An application can
request a DLL file in a variety of ways, and Windows uses several
different search algorithms to find DLL files. The interaction
between the application and Windows can result in a DLL file being
loaded from the current working directory of the application,
instead of the Windows system directory or the directory where the
application is installed.

The current working directory could be the desktop, a removable
storage device such as a USB key, a Windows file share, or a WebDAV
location. When a file associated with an application is opened, a
DLL in the same directory as the file may be loaded. Although an
attacker may not have permission to write to the Windows system or
application directories, the attacker may be able to write a DLL to
a directory used to store files, or the attacker could provide
their own directory.

Attacks against this type of vulnerability have been referred to as
“binary planting.” Please see Vulnerability Note VU#707943 and
Microsoft Security Advisory 2269637 for more information.

II. Impact

By placing a DLL with the correct name (and possibly the relative
directory path) in the current working directory, an attacker could
execute arbitrary code with the privileges of the application that
loads the DLL.

III. Solution

Individual applications that run on the Windows platform may
require patches or updates. Microsoft Knowledge Base article
KB2264107 describes an update that provides a registry key that can
prevent Windows from searching the current working directory for
DLL files.

Information about specific solutions for different vendors, general
mitigation techniques, and secure ways for applications to load
DLLs can be found in the Vendor Information and Solution sections
of Vulnerability Note VU#707943.

IV. References

* Vulnerability Note VU#707943 -

* Microsoft Security Advisory (2269637) -

* A new CWDIllegalInDllSearch registry entry is available to control
the DLL search path algorithm -

____________________________________________________________________

The most recent version of this document can be found at:
____________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send
email to with “TA10-238A Feedback VU#707943″ in
the subject.
____________________________________________________________________

For instructions on subscribing to or unsubscribing from this
mailing list, visit .
____________________________________________________________________

Produced 2010 by US-CERT, a government organization.

Terms of use:
____________________________________________________________________

Revision History

August 26, 2010: Initial release

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBTHbPuj6pPKYJORa3AQI0Rwf+JjLbBdWxKa+8pzCefxhs+maIjzihg/vN
ZNF90uuFgMAdIrTD7+Qlv6TUc3ep/O28Dg11K8rXaOfxeyPsItMwpbz7vrpoUC5W
qvu6pYQnmhW/egryPPC8cwFecuDaTNNWDShwQ8oULXnp2mfj9q3LUvVOvLXaiwXs
rivmLthvhCjWBYpYFBb9yHjHOcQd4JQ0LS4A4BRzXGKTTgMnRvawPeHFQvsMlR0M
plrIJ4Lht3eOis97Rot9BIIcYytM74ctz6TwCwOz5JPTA1ncikEzoLhaKCQ2egpq
GmyjcQLo83JWRxDkBE9EkBhkpOjyhsvpVLZoJrqpkwKtJMUVeLcBBw==
=M/vJ
—–END PGP SIGNATURE—–

—

If you have questions or need assistance with this issue, please call 864.990.4748 or email info@homelandsecureit.com

Homeland Secure IT Alert

Secure IT Alert #2 for Thursday, August 26 2010

More bad news for Mac owners. PLEASE update your systems. We are seeing the number of Mac and *nix exploits ramp up at an alarming rate. Many people have found rootkits were installed on their systems for no telling how long before they were discovered.

The following information was provided courtesy of WatchGuard. Fantastic firewall devices at reasonable prices! If you should be interested, we are a partner with WatchGuard and offer their full line-up.

 

Malicious Documents and Images Threaten OS X

Severity: Medium

24 August, 2010

Summary:

• These vulnerabilities affect: All current versions of OS X 10.5.x (Leopard) and OS X 10.6.x (Snow Leopard)
• How an attacker exploits them: Multiple vectors of attack, including enticing your users into downloading and viewing various documents or images
• Impact: Various results; in the worst case, an attacker executes code on your user’s computer
• What to do: OS X administrators should download, test and install Security Update 2010-005 as soon as possible, or let Apple’s Software updater do it for you.

Exposure:

Today, Apple released a security update to fix vulnerabilities in all current versions of OS X. The update fixes thirteen (number based on CVE-IDs) security issues in seven components that ship as part of OS X, including PHP, CoreGraphics, and ClamAV. Some of the fixed vulnerabilities include:

• CoreGraphics Buffer Overflow Vulnerability. CoreGraphics is an OS X component that helps output graphics to your display (or printer). CoreGraphics suffers from a heap buffer overflow vulnerability involving the way it handles PDF files. If an attacker can get a victim to view a specially crafted PDF document (perhaps hosted on a malicious web site), he could exploit this flaw to either crash an application or to execute attack code on the victim’s computer. By default, the attacker would only execute code with that user’s privileges.
• ATF Buffer Overflow Vulnerability. The Apple Type Service (ATS) helps OS X machines handle fonts. ATS suffers from a buffer overflow vulnerability having to do with the way it handles embedded fonts. By tricking one of your users into downloading and viewing a malicious document containing a specially crafted font, an attacker can exploit this flaw to execute code on that user’s computer. By default, the attacker would only execute code with that user’s privileges. 
• Multiple PHP Vulnerabilities. PHP is a general-purpose scripting language primarily used to create dynamic web applications, which ships with OS X. Apple’s update fixes several vulnerabilities found in PHP 5.3.1. However, Apple only describes one of the PHP vulnerabilities in any detail. The vulnerability involves a buffer overflow flaw within one of PHP’s image handling function libraries. By enticing one of your OS X users into viewing a specially crafted PNG image (perhaps hosted on a malicious web site), an attacker could exploit this flaw to execute code on that user’s computer, with that user’s privileges.

Apple’s alert also describes other vulnerabilities, including some Denial of Service (DoS) flaws, information disclosure issues, and a few more code executions flaws. Components patched by this security update include:

ATS	CFNetwork
ClamAV	CoreGraphics
libsecurity	PHP
Samba

Please refer to Apple’s OS X 10.5.x and 10.6.x alert for more details.

Solution Path:

Apple has released OS X Security Update 2010-004 and OS X 10.6.4 to fix these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.

• Security Update 2010-005 (Leopard)
• Security Update 2010-005 (Leopard Server)
• Security Update 2010-005 (Snow Leopard)
• Security Update 2010-005 (Snow Leopard Server)

Note: If you have trouble figuring out which of these patches corresponds to your version of OS X, we recommend that you let OS X’s Software Update utility pick the correct updates for you automatically.

For All Users:

These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.

Status:

Apple has released updates to fix this flaw.

References:

• August 2010 OS X 10.5x and 10.6.x Security Update

This alert was researched and written by Corey Nachreiner, CISSP.

---

Did this alert help you? How could we improve it?
Let us know at lsseditor@watchguard.com.

For past alerts, log into the LiveSecurity Archive.

Jargon defined in the LiveSecurity Online Glossary.

—

If you require assistance please call us at 864.990.4748 or email info@homelandsecureit.com - we offer computer & network support to Greenville / Upstate, SC

Homeland Secure IT Alert for Thursday, August 26th 2010

I know it seems like it never ends… Adobe Reader, Adobe Acrobat, Adobe Flash, Adobe Air, Java, Windows, Mac, one update and patch after another following these security announcements….  

The vulnerability de jour is brought to you by Adobe, and it affects Shockwave player on Macintosh OSX and Windows platforms. The short and skinny is – update today, don’t delay….  What follows is information sent out courtesy of WatchGuard who makes a fantastic line of Firewalls, Network Security and Unified Threat Management Appliances for every application. We are proud to partner with WatchGuard and offer their products.

Adobe Shockwave Update Corrects 20 Security Flaws

Severity: Medium

25 August, 2010

Summary:

• This vulnerability affects: Adobe Shockwave Player 11.5.7.609 and earlier, running on Windows and Macintosh computers
• How an attacker exploits it: By enticing your users into visiting a website containing malicious Shockwave content
• Impact: An attacker can execute code on your computer, potentially gaining control of it
• What to do: If you allow the use of Shockwave in your network, you should download and deploy the latest version (11.5.8.612) of Adobe Shockwave Player as soon as possible.

Exposure:

Adobe Shockwave Player displays interactive, animated web content and movies called Shockwave. According to Adobe, the Shockwave Player is installed on some 450 million PCs.

In a security bulletin released late Tuesday, Adobe warned of twenty critical vulnerabilities that affect Adobe Shockwave Player 11.5.7.609 for Windows and Macintosh (as well as all earlier versions). Adobe’s bulletin doesn’t describe the flaws in much technical detail. It only describes the nature and basic impact of each flaw. For the most part, the flaws consist of unspecified memory corruption vulnerabilities. Though these flaws differ technically, most of them share the same general scope and impact. If an attacker can entice one of your users into visiting a website containing some sort of malicious Shockwave content, he could exploit many of these vulnerabilities to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PC. Adobe’s alert doesn’t describe what type of Shockwave content triggers these various flaws. However, other researchers’ alerts have disclosed that malicious Shockwave (.SWF) and Director (.DCR and .DIR) files can trigger these vulnerabilities.

If you use Adobe Shockwave in your network, we recommend you download and deploy the latest version as soon as you can.

Solution Path:

Adobe has released a new version of Shockwave Player, version 11.5.8.612. If you use Adobe Flash in your network, we recommend you download and deploy this updated player as soon as possible.

For All WatchGuard Users:

Some of WatchGuard’s Firebox models allow you to prevent your users from accessing Shockwave content (.SWF, .DIR, and .DCR) via the web (HTTP) or email (SMTP, POP3). If you like, you can temporarily mitigate the risk of this vulnerability by blocking .SWF, .DIR, and .DCR files using your Firebox’s proxy services. That said, many websites rely on Shockwave for interactive content, and blocking it could prevent these sites from working properly.

—

If you require assistance in in updating the Shockwave player, or specific instructions for applying the WatchGuard content blocks above, please call us at 864.990-4748 or email info@homelandsecureit.com – We provide network and computer support to Greenville / Upstate businesses and individuals! We offer sales of WatchGuard Firewalls and UTMs nationwide.

Our friends at Trend Micro Labs are watching out for you, even if you opt to not purchase their incredible anti-virus software!

If you are using Internet Explorer 6, 7, or 8 you could fall victim to what is known as  ”zero day exploit”, which is simply a hole that is found by the bad guys and a means for taking advantage of that security flaw is devised and deployed before the good guys can prepare for it.

The easiest application to exploit is Microsoft IE, because it is the most popular browser currently, and we just can’t stop clicking on links. We are addicted to clicking every link we find, and should one of those be a malicious site, we run the risk of becoming a victim if we do not have the latest patches, and sometimes with these zero day exploits, there IS NO PATCH.

Browser Guard 2010 from Trend Micro may help prevent your IE from leading you into trouble. As mentioned, it is a free download and works with IE 6, 7 and 8. If you are using an x64 (64 bit) system, you are out of luck though.

The following is extracted from their site:

Trend Micro Browser Guard is an easy to use browser plug-in, which prevents known and unknown web threats. Zero-day attacks such as Aurora and Hydraq can be proactively blocked by Browser Guard, which detects and prevents behavior associated with these types of threats.

Cybercriminals often use malicious JavaScript inserted into web pages, where attacks can take place silently, without any visible effect. Browser Guard also protects you from such attacks by analyzing and subsequently blocking malicious JavaScript. For the most advanced and efficient detection, Browser Guard communicates with the Trend Micro Smart Protection Network, bringing you the latest protection when you surf the web.

Key Benefits

• Protects against zero day exploits
• Detects buffer-overflow and heap-spray attacks
• Protects against execution of shell code
• Analyzes and protects against malicious JavaScript
• Connects with Trend Micro Smart Protection Network to maximize detections

CLICK HERE to go to the Trend Micro Browser Guard page.

If you are using Chrome, Firefox or another alternative browser, you can still become a victim, just not as easily due to the fact that these browsers are not being targeted as frequently.

If you have questions or require assistance, please call 864-990-4748 or email info@homelandsecureit.com – We offer affordable and fast virus removal and cleanup in Greenville / Upstate SC (If you suspect you have a virus, click here, then select the free online scan)