How secure is your cell phone?

A recent Computerworld article talked about a research paper by Daniel Brodie, Sr. of Lacoon Moblie Security. In this paper, Brodie talked about spyphones, surveillance tools surreptitiously planted on a user’s handheld device, have become more and more common. If you have been watching CBS’ Person of Interest, you would note the first thing that is done is that a spyphone is put on the subject’s cell phone. Now, you might think this is just Hollywood’s version of reality, but the truth of the matter is that it has become reality.

Lacoon Mobile Security partnered with several global cellular network providers to sample 250,000 subscribers in March of last year and again in October. The first sampling showed that 1 of 3000 devices had spyphone software installed. The second sampling showed the infections tripling to 1 in 1000 devices being infected. The initial survey showed that 74% were iOS (Apple) devices while the second showed the percentage dropping to 52% being iOS devices. The following chart from the research paper shows the percentage of devices infected by operating system.

Why the increase in infections? Lacoon Mobile Security identified more than 50 families of spyphones. As stated in the research paper “These spyphones run the gamut from dedicated high-end groups targeting specific nations and corporations, to low-end software targeting the private consumers…. At the lower end of the spectrum are spyphones which most commonly portray themselves as promoting parental controls and spouse monitoring.” What is more amazing is the cost of this type of software. Again from the research paper, Brodie noted

“The difference between the military and non-military grade spyphones? The device infection vectors and accordingly, their cost. Current estimates hold nation-targeted spyphones at $350K1. In the meanwhile, the commoners-targeted spyphones follow a monthly low licensing model– sometimes as low as $4.99.

The amazing part is that the end-result is essentially the same on the targeted devices. So for just a bit more than the price of a Starbucks latte, an attacker can purchase a spyphone with nearly identical capabilities to that of a top-end spyphone.”

The conclusion of the paper is even more interesting. Brodie concludes that “It is important to recognize that infection is inevitable.” But he also notes that we have seen this before in the computer desktop environment. The steps that we use to protect ourselves from malware in the desktop world are needed in the mobile world. The problem is that the tools to prevent mobile device malware are not there yet and the awareness of the problem is not large enough for the tools to be profitably developed.

How can you protect yourself? First follow the same rules on your phone that you do on your desktop computer. Be very careful on what apps you download. Keep up with what is happening on mobile device security. Talk to your IT Professional to help you defend against this new type of malware.

How to check your user licenses in Office 365

I recently got asked by one of my clients to check what users were on what plan in their Microsoft Office 365 account. You can imagine my surprise when Microsoft billing told me the only way to do this was to go down each user in the administrative portal, click on them and check the licensing page to see what license is assigned. I asked if there was a way to do this with Powershell and I got sent off to technical support. They found nothing that would do this in their quick technical answers and they would have to get back to me.

After a bit of research on my own, I ended up creating my own script to get the information. Here’s that script:

—————————————————————————————————

# Script to retrieve a licensing report from Office 365 and output it to CSV

# DISCLAIMER

# The sample scripts are not supported under any Microsoft standard support program or service.

# The sample scripts are provided AS IS without warranty of any kind.

# The entire risk arising out of the use or performance of the sample scripts and documentation remains with you.

# Created by Ted Giesler http://blog.cypgrp.com

Function Get-FileName($initialDirectory)

{

     [System.Reflection.Assembly]::LoadWithPartialName(“System.windows.forms”) | Out-Null

     $OpenFileDialog = New-Object System.Windows.Forms.SaveFileDialog

     $OpenFileDialog.initialDirectory = $initialDirectory

     $OpenFileDialog.filter = “All files (*.*)| *.*”

     $OpenFileDialog.ShowDialog() | Out-Null

     $OpenFileDialog.filename

     If ($Show -eq “OK”)

        {

        Return $objForm.FileName

        }

    Else

        {

        Write-Error “Operation cancelled by user.”

        Exit

        }

} #end function Get-FileName

# *** Entry Point to Script ***

# load the MSOnline PowerShell Module

# verify that the MSOnline module is installed and import into current powershell session

If (!([System.IO.File]::Exists((“{0}\modules\msonline\Microsoft.Online.Administration.Automation.PSModule.dll” -f $pshome))))

{

    Write-Host “The Microsoft Online Services Module for PowerShell is not installed. The Script cannot continue.”

    write-host “Please download and install the Microsoft Online Services Module.”

    Exit

}

$getModuleResults = Get-Module

If (!$getModuleResults)

{

    Import-Module MSOnline -ErrorAction SilentlyContinue

}

Else

{

    $getModuleResults | ForEach-Object

        {

            If (!($_.Name -eq “MSOnline”))

        {

        Import-Module MSOnline -ErrorAction SilentlyContinue

        }

        }

}

# Connect to Microsoft Online Service

Connect-MsolService -Credential $cred -errorAction silentlyContinue -errorvariable $er

$users = Get-MsolUser -all

# Setup the output file

$defaultfolder = $Env:UserProfile + “\documents”

$outfile = GEt-Filename ($defaultfolder)

$header = “userPrincipaName,usageLocation,isLicensed,accountSKUid,servicePlan1,provisioningStatus1,servicePlan2,provisioningStatus2,servicePlan3,provisioningStatus3,servicePlan4,provisioningStatus4,servicePlan5,provisioningStatus5”

Out-File -FilePath $outfile -InputObject $header

# Write-Host $header

foreach($usr in $users)

{

    $lineOut=$usr.UserPrincipalName + “,” + $usr.usageLocation + “,” + $usr.isLicensed + “,”

    foreach($lic in $usr.Licenses)

    {

        $lineOut = $lineOut + $lic.AccountSkuID

        foreach($s in $lic.ServiceStatus)

        {

            $lineout = $lineout + $s.ServicePlan.ServiceName + “,” + $s.ProvisioningStatus +”,”

        }

    }

    Out-File -FilePath $outfile -Append -NoClobber -InputObject $lineOut

    # Write-Host $lineOut

    $lineOut = $null

}

Write-Host -ForeGroundColor BLue “Please review your output file at ” $outFile

————————————————————————————————————————–

This script will create a comma separated file showing each user and each license category that user has a license. Unfortuantely, this does not match nicely to the Office 365 plans. You will have to add the specific licenses together to try and match your Office 365 Plan licenses.

Hopefully this will help others looking for the same type of answers.

How are you most likely to get attacked by Malware?

Recently the Microsoft Trustworthy Computing group released their Microsoft Security Intelligence Report covering the first half of 2012. It is interesting to look at where most malware comes from and what has been the most vulnerable software.

The most prevalent method of malware distribution according to Microsoft had been what they call “unsecure distribution chains.” Fallowing in this category are websites that distribute “free software”, both legal and not legal. Some of the popular software names listed by Microsoft as containing malware include:

  • keygen.exe
  • mini-KMS_Activator_v1.1_Office.2010.VL.ENG.exe
  • AutoCAD-2008-keygen.exe
  • SonyVegasPro Patch.exe
  • Nero Multimedia Suite 10 – Keygen.exe
  • Adobe.Photoshop.CS5.Extended.v12.0.Keymaker-EMBRACE.exe
  • Call.of.Duty.4.Modern.Warfare.Full-Rip.Skullptura.7z
  • Guitar Pro v6.0.7+Soundbanks+Keygen(Registered) [ kk ].rar

They also listed a number of movie named files that contained Malware, including:

  •  The Avengers 2012 720p BDRip QEBS7 AAC20 MP4-FASM.avi
  • Prometheus 2012 DVDRip.avi
  • Wrath of the Titans 2012 DVDRip aXXo.avi
  • Battleship 2012 DVDRip.avi
  • What to Expect When You’re Expecting 2012.BRRip.XviD-KAZAN.avi
  • The Hunger Games 2012 TRUE FRENCH DVDRIP XViD FiCTiON L S79.avi
  • Sherlock.Holmes.2.A.Game.of.Shadows.2012.DVDRip.XviD-26K-0123.avi
  • The Five-Year Engagement 2012 HDRip XviD-HOPE.avi
  • Project X 2012 TRUE FRENCH DVDRIP XViD FiCTiON L S79.avi
  • Amazing SpiderMan 2012 DVDRiP XviD.avi

When looking at what got attacked by malware, the report notes that of the 3 categories, core operating systems, browsers and applications, most malware attacked applications and least attacked were core operating systems, In the application category, Java and Java Script were by far the most attacked, followed by Adobe readers and Adobe flash.

What was even more interesting is that when looking at the implementation of updates of these four applications, over 50% of users were missing the latest updates. In the case of Java, over 90% of users did not have the latest updates installed.

Looking at infections by operating system, Windows XP had the highest percentage of infections at 9.5% of estimated installed computers while Windows 7 SP1 64-bit had the lowest at 3.1%.

So what should a user learn from this report?

  1. Be careful what you download. You may get more than you asked for.
  2. Install your updates. Not just Microsoft ones but Java and Adobe are key.
  3. Run a current operating system. The newer the OS, the less likely you are to get infected. Remember, support for Windows XP ends April, 2014.

Office 2013 Pricing puts the screws to small businesses

Microsoft has announced pricing for the newest version of the popular Office Suite of products. Like the announced death of the popular Small Business Server, Microsoft is killing off many of the advantages of popular Office suites. For Office 2013, all the purchased suites will be single license suites. This will remove two of the three licenses included in the Office Home and Student suite and one license in the Office Home and Small Business suite.

In its place, Microsoft is recommending their new subscription series of Office Suites. The Office 365 Home Premium subscription will give you 5 licenses, 3 times the amount of SkyDrive storage (20 GB added to the free 7GB), and 60 minutes of Skype phone calls for $8.33 per month. You will be billed $99.99 at an annual basis. The Office 365 Home Premium subscription includes Word, Excel, PowerPoint, OneNote, Outlook, Access and Publisher. The subscription covers both Mac (excluding OneNote, Access and Publisher) and PC versions of the product.

The Microsoft Office 365 Small Business Premium suite offers the same products and throws in Lync. Like the old Office Home and Small Business suite, the licenses are per user, but can be installed on 5 devices. The Office 356 Small Business Premium user will get a 25GB Outlook mailbox, the ability to host online meetings with audio and video using on-click screen sharing. They will also be able to setup a public-facing website for no additional fees. The cost per user is $12.50/user/month and is billing annually at $149.99.

In the Micorosoft announcement page (http://blogs.office.com/b/office-news/archive/2012/09/17/the-new-office-365-subscriptions-for-consumers-and-small-businesses.aspx) information on traditional retail box purchase options are found in a single paragraph at the bottom of the announcement. Office 2013 Home and Student is now a single license product selling at $139.99. No pricing information was given on any of the other options.

So what does this really mean? I really don’t work with home users, so I will not make any assumptions on how long people go between updates, so I can’t really compare the subscription price to the box price. Currently, Office 2010 Home and Student is a 3 license product selling on the street for $121.99. With a license to license comparison, that is a 246% price increase (99.99 * 3 = 299.97 / 121.99).

I can make assumptions from a small business perspective. Most of my clients are on a 5 year replacement plan. So my typical user has one, possibly two installations of Office; one being a workstation and one being a laptop. The majority only have one instance, so for this example, we will ignore the second “mobile” license included in Office 2010 Home and Small Business and the extra 4 licenses in the Office 2013 subscription. Comparing the Office 2010 street price of $247.99 to the new subscription price for a 5 year time span, we have a 302% (149.99 * 5 = 749.95 / 247.99) price increase.

So what am I recommending to my clients? Buy now before you pay through the nose.

Don’t be Collateral Damage

The last few months have seen some real interesting news in the area of computer security. First there was the Stuxnet virus that attacked Iran’s nuclear capabilities. Then there was the announcement of the Flame virus that not only could affect software, but could turn a computer into a fancy eavesdropping device And just this week, Tech Central.ie reported a cyber-security think tank has published a manual studying how international law applies to conflicts in cyberspace, where the laws of conventional warfare are more difficult to apply. The manual comes from experts working with the Cooperative Cyber Defence Centre of Excellence (CCDCOE), an institute based in Tallinn, Estonia, founded in 2008 that assists NATO with technical and legal issues associated with cyber warfare related issues.

As the political party conventions have ended here in the US, both parties are talking about Cyber Security as a national threat. The White House is circulating a draft of an executive order aimed at protecting the country from cyber-attacks according to The Hill’s Technical Blog. The Republican Party has responded with a plank in their platform calling for voluntary cooperation between companies rather than another governmental organization.

It’s not just on a national policy level that major security issues. Google has admitted that its online mapping service cars snatched data from private wireless hotspots. Considering that a recent study done by the University of Illinois found that only half of all users change any defaults at all on the most popular brand of wireless router, can the company that has an informal motto of “Don’t be Evil” be really trusted with what they have found?

I haven’t even touched upon the criminal or simply vandalistic element that we have all seen over the last few years.

We have all heard about collateral damage in war zones. I would contend that if you are on the Internet, you are in a war zone. Are you already or are you going to be “collateral damage”? Have you reviewed your defenses for this new age? What could you afford to lose if you are hit, even if you weren’t the target? Contact your IT Professional and have them check your environment. And when the cost estimates arrive, balance not just the cost dollars, but also the potential dollars that could be lost if you become collateral damage.

Apple beats Samsung in court. So what.

I’m sure many of you have heard that Samsung lost a patent infringement suit in California Patent Court earlier this week. Yes, we may be paying more for smart phones for a short while. Yes, Samsung may have overstepped “taking design inspirations” from the iPhone. Yes, this may have a ripple effect on all the other patent suits that are pending between the giant technology companies. But all of this is nothing new.

As nearly everyone that has been in the tech industry knows, everything is “stolen” from someone else. Apple “stole” their user interface from technology developed by Xerox in their PARC research lab. But Xerox couldn’t figure out how to sell that technology. Microsoft was “inspired” by the Apple user interface and developed Windows™.

Back when I was in software development, I used to say that there was no such thing as an original program. Every program was copied something from somewhere else and then stuff was added to the original. I’m sure that even the “first” program was just a set of instructions that was translated to something a machine could do.

Innovation should be rewarded. But now, companies claim innovation and pay lawyers to prevent anyone from saying it isn’t. I have a friend that was awarded several patents for things he did when working in the telecommunication industry. He told me that he didn’t think what he had done was anything really special, but the lawyers made it look special so they could stop anyone else from coming up with the same answer when confronted with the same problem.

I cannot really see that a rectangular shape for a phone is patentable. Many phones before the iPhone were basically a rectangular shape. The dimensions of the rectangle of a phone or proportions between the dimensions are probably more a function of human ergonomics and technical requirements. Are ergonomics now patentable? Are companies going to sue people because a shape feels comfortable and they make something in that shape?

In the technical world, innovation really comes from using something you learn (so someone else did it first) for something different than what it was originally intended. Or taking something that already is and finding a way to automate it. If this infringes on patent law, then patent law needs to be changed.

Those that work in the Shadows

Now that the Olympic Games are over, I think congratulations should go out to all the five hundred and some odd US athletes that competed in the games. Having relatives that could have gone to that level in their prime, but choose to study more than train, I have an idea of the sacrifices those that qualified to compete in the games have made.

And also congratulations to the City of London for pulling off a spectacle and event of that level without any of the major problems that were predicted by the nay-Sayers before the games started.

As we in our daily lives discover, those that look the best have done the most work in the shadows, the background, out of sight. That’s why a lot of times your IT consultant will recommend something you have never heard of to resolve a concern. Many times the names you have heard in the IT world are focused on things you, as a small business, are not concerned with. They may have a product, for example in anti-malware, that you have heard of for years, but their focus is on the enterprise market and not the small business.

What are the ramifications of the difference in focus? Typically it is the resources that are required to run the given application or service. Although this is changing as businesses grow and technology gets less expensive, multiple single application servers are not the norm in the small business environment. So, even in a world of virtualization, single servers for a given application may be out of reach.

That is why an IT consultant that specializes in small business is the best choice for a small business. They spend the time with the unknown vendors to find the right application for their clients. These applications may not work in the enterprise world, but are a best fit for the small business world. In many cases, these consultants will go out of their way to find a solution that may not pay them as much, but is the right solution for the client.

Cautious, careful people, always casting about to preserve their reputation and social standing, never can bring about a reform.”

–Susan B. Anthony,
American activist