Bye Bye PC, I've had it!!!

[Palmpilot]

Re: Unix vs OSX vs Linux vs Windoze security

This is certainly an interesting thread!

2a) This is why network admins start by flipping off services in Cisco routers (especially source routing!) and unix servers (and if they don't, they should be fired)

Hmmm...Having just installed a Cisco router, sounds like I'd better read up in the manual about how to do this!

 

[JesseD]

Securing a Cisco device

This is certainly an interesting thread!

Hmmm...Having just installed a Cisco router, sounds like I'd better read up in the manual about how to do this!

Thanks for the vote of interesting :wink2:

Yes, there are a ton of services on a cisco router that should be flipped off, and a big one is source routing, but there's a lot of detrius leftover from the early days thats unused. If you have the SDM (or the replacement CCP), and you aren't comfortable at the CLI, you can quick secure it. Be careful you don't break something else though, save a copy of your config

I still recommend CLI if you can use it. Double-check your security policy too, some of those older services may still be in use. Unlikely, but possible.

 

[JesseD]

Re: Unix vs OSX vs Linux vs Windoze security

Most NetBSD installs are machines performing fairly important tasks while often being responsible for protecting VERY sensitive information in mass quantities. Not your "typical Windows machine". Pretty much all servers are attractive targets because of the data they guard. An attack that would give you root access against any NetBSD box would be *extremely* valuable.

Many of the "vulnerability counts" against Unix or Linux systems in comparison to Windows are *completely* biased. Windows ships with almost no software. Most modern Unix/Linux distributions ship with thousands of different software packages. If you took all the software available for Windows and their associated vulnerability count compared to a *nix distribution you'd see a very different picture.

A lot of the "vulnerabilities" in the open-source world are discovered by people reading the source and fixed before anyone ever takes advantage of it. Those sort of holes just rot in the closed-source community until the wrong person finds them who then takes advantage of them. Let all the developers in the world read the Windows source and many of the popular Windows programs and you'd see a MAJOR flood of issues.

The majority of the "virus writers" programming all that ask-for-credit-card/spam **** really aren't that smart, thankfully. There are some very very scary smart guys out there that could do a lot of damage but are smart enough to apply their brain in other directions in technology in a more positive light.

Ahh, but you have to rate it as value per dollar, per hour. If I can release a bug that infects 100,000 machines, and 1000 of those users pay US$50, and I can sell the CC numbers for another $5000, and I did it with 2 hrs of real work...

Contrary to belief, they are pretty smart, but it's all criminal gangs now. Technically they aren't as advanced as the kids that figure out how to own a lot of boxes. Then again, their goal isn't to own a box, it's to collect money. Information is only valuable if you can turn it into money for most people, and most can't without grief. Granted, you'll get those with other motives (embarrassment, intellectual property theft, et al.) but the filthy lucre drives most of it.

Let me put it this way, it's better for them to rent out a botnet or blackmail someone like Amazon with a DDoS, or send out a bunch of spam, than it is to try and sell proprietary information. They can get the cash money for the first two, but they might not have a way to sell the design for that neat new chip. Oh, and don't forget that if they PCI compliant their targets (Amazon, Buy.com, et al.) are only storing "tokens" not CC numbers on their servers, and those tokens are useless to others.

Also, consider that today (and for more than a few years really) it's the services and software (ftp daemons, Flash) that is really being compromised more than the operating systems themselves. Even browsers are (relativistically, compared to 2005) hardened in and of themselves. Email programs? Same thing. So the low-hanging fruit being the best for these guys, they move onto them or to user "authorized" attacks. (Click "Yes" to install) Remember that shirt I told you about?

That's why I snicker when I see the whole "Windows is weak" argument. No, many of the services and applications (which are voluntarily installed by illiterate users) can be unsafe. Then again, so is a *nix box set up by a admin neophyte. There is nothing more fun for a security consultant than to find a raw *nix box in the DMZ. That's an even bigger gift than the average Windows server because those complain about automatic updates being turned on and even new sysadmins are paranoid about updating them. Then gain, the *nix box "is more secure" than Windows so it is often left with a whole bunch of useless crap running to exploit.

 

[Palmpilot]

Re: Securing a Cisco device

Thanks for the vote of interesting :wink2:

Yes, there are a ton of services on a cisco router that should be flipped off, and a big one is source routing, but there's a lot of detrius leftover from the early days thats unused. If you have the SDM (or the replacement CCP), and you aren't comfortable at the CLI, you can quick secure it. Be careful you don't break something else though, save a copy of your config

I still recommend CLI if you can use it. Double-check your security policy too, some of those older services may still be in use. Unlikely, but possible.

I don't even know what those abbreviations stand for!

 

[jesse]

Re: Unix vs OSX vs Linux vs Windoze security

Ahh, but you have to rate it as value per dollar, per hour. If I can release a bug that infects 100,000 machines, and 1000 of those users pay US$50, and I can sell the CC numbers for another $5000, and I did it with 2 hrs of real work...

Value per dollar - the key to the fortress holding all the numbers in the first place - is more valuable. The problem is that these systems are inherently more secure. It's pretty silly to compare Windows security to NetBSD installations.

Oh, and don't forget that if they PCI compliant their targets (Amazon, Buy.com, et al.) are only storing "tokens" not CC numbers on their servers, and those tokens are useless to others.

I suggest you review the PCI Data Security Standard. You can store credit card numbers and those tokens map to real credit card numbers. You just use the tokens to limit the scope of your PCI environment.

Example - you use a third-party payment processor like Authorize.NET to store the credit card numbers. They'll then give you a token that you store in your non-pci-compliant servers. Authorize.NET *is* storing credit card numbers and they are PCI complaint.

Or you may want to store the credit card numbers yourself. To limit scope you'll build out a separate PCI-complaiant environment completely separated from the rest of your infrastructure. You'll then pass tokens back to your primary application's environment.

There are systems out there storing HUGE quantities of credit card numbers that are fully PCI compliant. The problem is that these systems are inherently more secure and ran by very smart people in very secured environments. They are not easy targets. It's much easier to social engineer the stupid and attack the weaker systems (the desktop).

I'd like you to compare security vulnerabilities that have been present in the default install of Windows Server in comparison to OpenBSD. One can be counted on one hand by a farmer missing a few fingers. The other is going to need a database.

 

[flyingcheesehead]

BTW, there are plenty of options these days for running "PC Only" software on the Mac. Ever since they switched to Intel processors, it's been very easy to recommend the Mac even to people who need a "PC". For example, right now I'm running Linear's LTSpice (circuit analysis program) on my Mac via CrossOver.

There are four options that I know of: Boot Camp, Parallels, VMWare, and CrossOver. Boot Camp is Apple's free dual-boot solution. Parallels and VMWare can run a virtual machine within the Mac OS. CrossOver is an emulator (based on WINE).

CrossOver is the only one that does not require a copy of Windows, but there are a lot of programs that aren't compatible with it because of that. Boot Camp is the only one that requires a reboot to switch operating systems. The other two run Windows and the Mac OS simultaneously.

Well, there's a new option.

VirtualBox by Oracle is along the same lines as Parallels and VMWare - Run Windows, in a window, on the Mac OS. As in, both simultaneously - But VirtualBox is FREE. (You still have to obtain a copy of Windows to install on it, just like Parallels/VMWare.)

I have it running now, to try out some software that didn't work with CrossOver. Seems to run pretty well so far, Windows annoyances excepted.

 

[PilotAlan]

We switched from a PC house to a Mac house about a year ago. I am finishing my degree (done in two weeks!) so switching platforms in the middle of classes was a bit of a challenge, to say the least.
But what I found it I spend my time on the Mac working, rather than getting the PC to do what I need it to do. I don't have to spend any significant time tweaking or fixing things.
I'm no PC novice. I built the first 10 PCs I ever owned, and only started buying off-the-shelf PCs about 8 years ago.

One example was my HP 1312 color laser network all-in-one. Every PC required a huge install of a half dozen apps, and lots of work to get the scanning and faxing to work over the network (then troubleshooting every couple of months when it quit working).
With the Mac, I pointed the printer and scanner settings window at the network and everything installed in just a minute or two. And it's worked flawlessly ever since.

There's a couple of things I needed from Windows, like Access for a few classes and Voyager flight planning (that I bought a lifetime subscription for about 3 years ago), and a couple work related web applications that MUST have IE.
Parallels with Win7 and no troubles.

I'm a happy Mac owner.

 

[Eamon]

The Facebook "koobface" virus just rendered our home pc useless. I am posting with a laptop!

http://www.snopes.com/computer/virus/koobface.asp

All these viruses usually ask you click here to download a update or codec.

If something tells you your "flash player" is out of date DONT CLICK ON IT!! Instead shut down your browser, open it back up & go to the software site directly & get the update, if you even need one. If you put "flash update" (or whatever update message you get) into the google box, it sends you to Adobe. The parent site will tell you what the latest update is & you can get it if you need it.

If you click on something with a Mac, you can still get a virus.

I use a iMac desk top & a PC laptop with no anti-virus software.
I surf porn every night with Firefox & I have never had a virus.

Don't click, Don't open & no virus.

 

[denverpilot]

Well, there's a new option.

VirtualBox by Oracle is along the same lines as Parallels and VMWare...

VirtualBox is far from "new", it's been around for years. We use a server running it and multiple copies of Winderz to centralize our access to customer's networks at work, since every customer has a different VPN client, many are incompatible when loaded on the same PC, and we all might need to look at any customer's problems directly via their VPN solution.

Have used both the Microsoft virtualization stuff and VMWare in the past. VirtualBox got into the game when it started to work better with less resources untilized on the server. Early versions of VB were dogs, performance-wise.

Ubuntu + VB on the server now, 8 or so virtualized machines per server. RAID 0+1 under the hood for the disk space and speed needed on 15K RPM drives, 8GB RAM, forget which CPU but something relatively cheap, dual-core. Two of them. Works great.

As far as the Mac vs. PC security debate goes, Macs will get hacked, and have the same browser vulnerabilities. The issue is how they're just slightly better at sandboxing away the ability to have Administrative rights. Makes them just hard enough that it's easier for the 20-something's to hack the PCs instead.

Comparing "Uncle Bob's" Windows XP SP1 unpatched that he surfs porn on, to an auto-updated Mac OSX machine, security-wise, isn't truly fair either. If Windows users stayed up to MSFT's latest and greatest Win7 versions... They'd be much better off. And they'd have paid as much as buying a Mac in hardware and Windows upgrade versions to do it. IMHO.

If the argument is "market share", then don't those of us who know how to run secure machines owe it to those who don't topic them on the product least likely to get attacked? ;-)

 

[SkyHog]

Well, there's a new option.

VirtualBox by Oracle is along the same lines as Parallels and VMWare - Run Windows, in a window, on the Mac OS. As in, both simultaneously - But VirtualBox is FREE. (You still have to obtain a copy of Windows to install on it, just like Parallels/VMWare.)

I have it running now, to try out some software that didn't work with CrossOver. Seems to run pretty well so far, Windows annoyances excepted.

NEW?!?!?!?

3/10/2010: http://www.pilotsofamerica.com/forum/showpost.php?p=568133&postcount=11
1/25/2010: http://www.pilotsofamerica.com/forum/showpost.php?p=547831&postcount=1
2/22/2009: http://www.pilotsofamerica.com/forum/showpost.php?p=414962&postcount=22

Bah!!! I've been saying for YEARS that Parallels is a ripoff. VirtualBox owns all - and its cross platform, runs on Windows, Linux or OSX. I even had a thread fight with Jay Maynard over it, because he was as obsessed as every other Mac user over Parallels.

And it can run headless, for virtualizing servers. I absolutely love VirtualBox, and would not be able to do half of the nerd **** I do at home without it.

edit:
In fact, it works so well, I have an entire farm of Linux PCs running on one of my development servers in it, so I can test out a bunch of different distros at the same time. Its great.

The one thing it lacks is being able to boot into the virtual disk natively, which I think I remember reading that Parallels allows.

 

[Henning]

I tend to be the extended family / friend computer guy. The new generation of viruses and malware are so hard to get rid of that my policy is this: buy an external drive for your personal documents, because when I get your infected computer it's going to get wiped and reinstalled.

I use AVG Free edition and Malwarebytes and never have a problem anymore.

 

[denverpilot]

Bah!!! I've been saying for YEARS that Parallels is a ripoff. VirtualBox owns all - and its cross platform, runs on Windows, Linux or OSX. I even had a thread fight with Jay Maynard over it, because he was as obsessed as every other Mac user over Parallels.

Yeah, it works well for anything that doesn't require graphics acceleration. Get into doing something like trying to play a Windows game that's graphics intensive on a Mac, and you'll want Parallels or VMWare. Which one you want, probably depends on the day and which of the million dot-patch levels they all constantly put out, that you're running. What patch level of the game, too.

(Joke: "I just came from the men's room." "Oh yeah, was that a software or a firmware release today?")

Most "geek stuff" as you put it, just the need to run multiple OS's on a box, VirtualBox works fine. VirtualBox (because it was Sun's code before they were bought by Oracle) can also host various flavors of Solaris, something the others don't do very well at all, but there are some annoying limitations, like ... we had a VERY nice 64-bit Sun box sitting here (Enterprise class), but couldn't run 32-bit Windows inside VMs on it. Too bad, since it would have been even faster than the pizza-box cast-off-from-IT that we ultimately used to host the Windoze VM's.

I use AVG Free edition and Malwarebytes and never have a problem anymore.

I got tired of AVG begging me to pay for the full version, and I also had some weird crashes when it would do full scans, which being a "free" version there was no support for. Their forums were useless on the topic, but other's had seen it.

Then I read a couple of security trade-rag articles about how Microsoft's security division had slowly and quietly created their own antivirus and other tools, but didn't market them heavily because a) people tend to not believe that the fox will guard the hen-house, and b) they have too many "business partners" that make anti-virus software for their crappy vulnerable OS, and they didn't want to tick those "partners" off... big money selling AV software to business these days, ya know?

But... at the end of the day, a number of 3rd party security experts pointed out that Microsoft Security Essentials did just as good or better of a job detecting virii as did many PAY versions of software, utilizing less system resources to do it. (McAfee, I'm looking at you, you pig-dog system killer. Hate. Hate. Hate.)

Many people don't realize that MS Security Essentials is a free download for XP... and think it's only available on Vista and 7. It's free, works great, and doesn't have limitations on it that the vendors like to put on their "free" versions like "Thou shalt only run manual scans, and if you want scheduled scans thou shalt buy the pay version".

Been running the MS stuff now, and removed all others, on the very few Windows machines and VMs I need for things, which is slowly now down to one Windows VM... and it lives on my MacBook...

Even stranger, I haven't booted the MacBook again in a month, with the iPad handling far more than the 80/20 rule than I thought it would. It's a very powerful little tablet. Doing more with it than I ever expected.

The Windows VM inside that MacBook that hasn't been booted, of course, hasn't booted for at least two months. In fact, the biggest pain right now is booting all of these OS's and things I'm NOT using up at least once a month to catch critical security patches. LOL. Tonight is probably that night, since I'm a geek and have such big plans for a Friday night. HA!

For the few things I do on a "real computer" right now... recording/editing the podcast, via Skype, etc... I just log in as a second user on my wife's iMac that sits in the living room... on the coffee table.

The whole concept of going to the "Computer Desk" in the basement has been busted for almost a year at my house... I've been slowly disassembling the machines, and selling them off or recycling them. I just sit on the couch with the iPad.

Was looking last night at MacBook Pro prices, and realizing that I'm probably never going to do it unless I need to video edit on the road... no need for a screamer laptop when you have the iPad... unless you were doing mobile A/V editing.

Especially now that Pages/Numbers are out for iPad... can write, and do spreadsheets, and put 'em up in DropBox... I don't really need to carry a laptop anymore, but I still drag it around in the backpack out of habit, and never boot it. LOL!

 

[flyingcheesehead]

If you click on something with a Mac, you can still get a virus.

True - But most of 'em won't run, and on the Mac you not only have to click the link, you have to specifically tell it that it's OK to run that program (the OS disables any apps downloaded from the internet until you OK them on the first launch) and if it tries to make any changes to your system you'll have to type in an administrator password too.

There's no malware in the world that won't get past an ID10T error.

 

[flyingcheesehead]

VirtualBox is far from "new", it's been around for years.

NEW?!?!?!?

3/10/2010: http://www.pilotsofamerica.com/forum/showpost.php?p=568133&postcount=11
1/25/2010: http://www.pilotsofamerica.com/forum/showpost.php?p=547831&postcount=1
2/22/2009: http://www.pilotsofamerica.com/forum/showpost.php?p=414962&postcount=22

Bah!!! I've been saying for YEARS that Parallels is a ripoff. VirtualBox owns all - and its cross platform, runs on Windows, Linux or OSX. I even had a thread fight with Jay Maynard over it, because he was as obsessed as every other Mac user over Parallels.

And it can run headless, for virtualizing servers. I absolutely love VirtualBox, and would not be able to do half of the nerd **** I do at home without it.

edit:
In fact, it works so well, I have an entire farm of Linux PCs running on one of my development servers in it, so I can test out a bunch of different distros at the same time. Its great.

The one thing it lacks is being able to boot into the virtual disk natively, which I think I remember reading that Parallels allows.

Somehow, I missed it before...

It seems to me that VMWare is better than Parallels if you have a burning need to spend money on something. IIRC Scott had to use VMWare to do Garmin updates, and Parallels STILL doesn't support 64-bit Windoze.

But, now that I'm aware of VirtualBox and have it installed, I'm pretty impressed. It works far better than most free software I've used. No complaints at all yet... Well, not with VirtualBox itself. The experience of actually using Windows, however... I can't believe you people put up with that crap.

 

[flyingcheesehead]

Yeah, it works well for anything that doesn't require graphics acceleration. Get into doing something like trying to play a Windows game that's graphics intensive on a Mac, and you'll want Parallels or VMWare. Which one you want, probably depends on the day and which of the million dot-patch levels they all constantly put out, that you're running. What patch level of the game, too.

Or if you want 64-bit functionality or custom hardware.

Even stranger, I haven't booted the MacBook again in a month, with the iPad handling far more than the 80/20 rule than I thought it would. It's a very powerful little tablet. Doing more with it than I ever expected.

Do I get to say "I told you so?" (Actually, I can't remember if I told YOU that, specifically, but I've said that to a number of people.)

The whole concept of going to the "Computer Desk" in the basement has been busted for almost a year at my house... I've been slowly disassembling the machines, and selling them off or recycling them. I just sit on the couch with the iPad.

The revenues from all that might even pay for the iPad!

I don't really need to carry a laptop anymore, but I still drag it around in the backpack out of habit, and never boot it. LOL!

I don't know anyone else who does that. Who would do such a silly thing?

 

[ScottM]

A classmate of mine ran virtual box last semester with Win 7. The only software she had trouble running was the ESRI ArcView GOS software we were using for some geoinfomapping work we were doing. I could run it fine with my VmWare +Win Vista combo. I have now upgraded to Win 7 on the PC side of the Mac but have not reloaded the ArcView software.

 

[bluesky74656]

A while ago I was looking at making, for lack of a better term, a 'travelling' Windows 7 install. On my desktop, I wanted to have it so I could either boot into the hard drive or virtualize in VirtualBox under Ubuntu, and also be able to boot a disk image on my MacBook using VirtualBox.

As I recall, VirtualBox supported, or at least allowed, everything I wanted to do. The issue I ran into is that you needed a new enough processor to be able to emulate 64bit. My desktop has an AMD64 chip, but apparently it wasn't new enough to include the 64bit virtualization technology.

So, I believe it is possible to both boot a hard drive in VirtualBox, and run 64bit images.

 

[SkyHog]

FWIW, VirtualBox does 64 bit too. I have a 64 bit Kubuntu install running right now.

 

[zaitcev]

Facebook isn't going anyway anytime soon and with every day that passes more and more businesses use it to communicate with their clients. We encourage the use in our company and we're not having issues with people becoming instantly infected with Facebook viruses. You'd have to be clicking through some really sketchy links to get yourself into that situation.

I quit using Facebook a few months ago, primarily because the pervasive tracking is becoming an issue. I did not throw any juvenile tantrums with final words or account deletion, but I make sure not carry their cookies (including Flash and HTML5) and keeping AdBlock lists up to date.

If a company wants to use Facebook to communicate, that's too bad.

 

[MadseasoN]

Stay off the dirty websites!

FWIW I use Norton on all 3 of our PCs. Never had a virus and I'm running 32-bit Windows XP on a 4 year old Celeron PC. Haven't tried any other Virus scanners yet.

 

[denverpilot]

Re: Securing a Cisco device

Yes, there are a ton of reasons a cisco router... and Cisco salespeople should be flipped off...

Ha... Was reading back through the thread and then realized I needed to fix that sentence. :wink2:

I have a love/hate relationship with that religion, er... gear.

 

[denverpilot]

Do I get to say "I told you so?" (Actually, I can't remember if I told YOU that, specifically, but I've said that to a number of people.)

Nah, your discussion and playing with your iPad at OSH last year, along with the beers at the party and the shot of Jeremiah Weed from Tupper, had me sufficiently lubricated that my last remaining skeptical brain cells against purchasing an iPad were killed off that night.

That said, I'm on the BlackBook, er... MacBook (yeah, I have the black one... Macs weren't particularly "welcome" at work back in the day, and helping it hide as a PC so I didn't have gaggles of people giving me rations of crap for buying a Mac back then was actually a consideration) right now, only because I fired it up to install iLife '11 and iWork '09 on it. I was behind on all the iStuff so I bought the Family Pack box set and upgraded everything this weekend.

I'm just jonesin' to go try out Foreflight on the new RAM yoke mount (or if it gets in the way too much, the "backup" suction cup mount) that has been sitting here ready to go for three weeks now, but you've seen what's keeping me grounded over in Maintenance Hanger thread...

Owner #1 is taking the chore of going over and authorizing the local MX folks to pull 79M out of her hangar and start investigating the fuel leak tomorrow PM. (It's nice to have a co-owner who can get away from work on weekdays...)

Depending on their schedule, we'll probably know in a few days how many AMUs she'll need to get her airworthy again, and how much time it'll take... if it's the bladder...

Meanwhile it was CAVU all weekend, and all my stuff hasn't come in for my taxes yet, so I did laundry and messed with the Mac while I had a bad case of the "I'd rather be flying" blues. Also chipped ice off the front porch since we were well above 60F today here, and made sure the river of water running in the gutter could get past the ice dam the giant fir tree creates out there every winter in the street since it blocks the sun. And my co-podcasters were out having fun with YOU... I hear. (They ALL bagged on recording an episode today, which did nothing to help my funk, but Doug and I talked on Skype for a while and I lived vicariously through his CAP C-182 flight stories since he did get to fly today.)

Oh yeah, I also went to a Colorado Wing Group 1 Communications meeting at KBJC on Saturday where we crammed far too many of us radio geeks into a little room and discussed radio geekery and lamented the lack of a good, automated, national, radio licensing system... and while it was enjoyable, sitting in a cramped room at an airport on a CAVU day is absolutely the worst thing ever.

Even if I took all my notes on the iPad! Which I did, of course. And enjoyed the over-the-air syncing to the other Macs via MobileMe.

 

[flyingcheesehead]

And my co-podcasters were out having fun with YOU... I hear.

Guilty. We flew to OSH, went to the EAA museum for a few hours, hopped over to SBM for dinner, and then headed home. It was a BEAUTIFUL day to fly!

 

[zaitcev]

I had a Linux desktop since about 1992, never a virus of course. However, I never bother to evangelize. Everyone in my family uses Windows, and they get malware from time to time. I had to get Norton for them eventually. Malwarebytes just wasn't cutting it.

 

[tdager]

I just do not get it. I purposefully go to "bad" sites due to my job, and yes I have been hit in the past, but nothing has required me to rebuild in over 5-6 years, NOTHING.

Just what the heck are you people doing?

 

[mikea]

I just do not get it. I purposefully go to "bad" sites due to my job, and yes I have been hit in the past, but nothing has required me to rebuild in over 5-6 years, NOTHING.

Just what the heck are you people doing?

They visit *cough* sites that tell them they need a plug-in to view content - click here to install and when it asks for permission click OK and turn off that stoopid pesky security program.

 

[zaitcev]

They visit *cough* sites that tell them they need a plug-in to view content - click here to install and when it asks for permission click OK and turn off that stoopid pesky security program.

My women are not that dumb but apparently they carry XP viruses from school on USB keys. Just like in 5.25" floppy days, amazing. I mean amazing that malware authors still bother writing for that attack vector.