Vol. 16, #48 - December 5, 2011 - Issue #857

Your Smartphone -IS- Spying On You!

  1. Editor's Corner    
    • Your Smartphone -IS- Spying On You!
  2. Admin Toolbox
    • Admin Tools We Think You Shouldn't Be Without
  3. Webinars & Seminars
    • VIPRE Antivirus Business Product Demonstration - 12/6, 12/13
    • Free Desktop Virtualization Seminar
  4. Tech Briefing
    • HP LaserJet Printers Vulnerable To Attacks, Researchers Warn
    • Network Admin Eats Humble Pie
    • IE 10 One Step Closer
    • Surprise! Certified IT Jobs Are Paying Less
  5. Windows Server News
    • Developing Mobile Apps For The Cloud
    • Local Storage For Virtualization: Will It Catch On?
    • Technologies And Trends To Be Grateful For In 2011
    • Hidden Gems In Windows Server 2008 R2?s Resource Monitor Tool
  6. Third Party News
    • Access Control and Security Management
    • VIPRE Business Service Release 1 Beta 2
  7. WServerNews FAVE Links
    • This Week's Links We Like. Tips, Hints And Fun Stuff.
  8. WServerNews - Product of the Week
    • New Free Tool - Real-time Bandwidth Monitor
      for Sub Second Device Polling and Interface Monitoring

 

New Free Tool - Real-time Bandwidth Monitor for Sub Second Device Polling and Interface Monitoring

Real-Time Bandwidth Monitor, SolarWinds? latest and greatest free tool, allows you to monitor interfaces on your network, see how much bandwidth is in use, or how much is traffic is currently on the interfaces. Now you can poll your interface as frequently as every half second. Set critical and warning thresholds to instantly see when usage is out of bounds. Monitoring a troublesome interface has never been so easy!

Download Real-Time Bandwidth Monitor

 

Editor's Corner

Your Smartphone -IS- Spying On You!

#FAIL! For most cell phone carriers. There is a process installed on most recent smart phones called Carrier IQ. You cannot stop this process. It looks at what is happening on the phone and sends every button you press to the IQ app. From there, the data ? including the content of text messages ? is sent to Carrier IQ?s servers, in secret. I checked it out on my own HTC Android phone from Sprint and sure enough, it's there.

It cannot be turned off without rooting the phone and then replacing the whole OS. Moreover, even if you stop paying for service from your carrier and just use Wi-Fi, your phone still reports to Carrier IQ. Dang! Worse, if you use Google search, and type in a search term, this is supposed to be https, so it should be encrypted. However, the Carrier IQ software sends it over Wi-Fi in cleartext: #DOUBLEFAIL.

This particular software is installed on hundreds of millions of handsets, including modern BlackBerry and Nokia phones, and early versions of Apple's iOS, but no one knew about it until Android developer Trevor Eckhart analyzed how it works. Carrier IQ's software is even running on every iOS version dating back to iOS 3, well-known iPhone hacker "Chpwn" said in a blog post. (Apple seem to have woken up with iOS5 where you can turn off Diagnostics and Usage in Settings.) Link to Chpwn here: http://www.wservernews.com/go/1322990280328

The software secretly logs pretty much anything that happens on a phone, supposedly for the reason that carriers and phone manufacturers 'can do quality control'. Yeah right, maybe so, but Carrier IQ can be served with subpoenas as well, and then all traffic is right there for Big Brother to be perused. Me no like. And think about compliance for a moment! This thing has a bunch of legal and ethical angles that the lawyers are just going to LOVE. I'm pretty sure the first class action lawsuits are being filed are you read this.

I would not be surprised if this will go all the way up to the Supreme Court, it is related to the the Fourth Amendment of the U.S. Constitution: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

Wow, what a privacy and security hole, unbelievable. Below is the 17-min video where he clearly shows what is going on. Eckhart calls it a rootkit, but that is a bit much, though it clearly qualifies as a Backdoor Trojan in my book.

Probably CIQ started out with the laudable idea to measure carrier and handset performance. But that is where it went off the rails in a hurry. Using code that acts like a backdoor Trojan is totally the wrong way to do that. I wonder if they heard of the Sony rootkit debacle of 2005?

The carriers (and Carrier IQ) have access to Android source code, and apparently they do what they want with it, without Google being able to object. Apple seems to have taken action, caused by user backlash. Google, I suggest you have a look into this... remember 'do no evil'?

Ben Scott remarked: "A while ago some people said, "Glad I'm on Verizon!". Then the apparent Verizon reporting was discovered. Other people were saying, "Glad I don't use Android!". Then Symbian and RIM reporting was discovered. Other people said, "Hah hah! Apple would *never* let this happen!" Then the iOS reporting was discovered. There appears to be a trend here." I wonder if the Carriers are in bed with the Feds,and that Law Enforcement is using this. Talk about privacy violations.

You can see the video where Eckhart demos what happens on Android. Not that I have anything to hide, but I'm going to root my phone now, or look for some app that rips out CIQ.
Video on WIRED:
http://www.wservernews.com/go/1322990470171

Update: Looks like Eckhart -has- some code that checks for CIQ and disables it. Less time than rooting a phone. Start here:
http://www.wservernews.com/go/1322990482187

Warm regards,
Stu Sjouwerman

Quote of the Week

"All things are difficult before they are easy". -? Thomas Fuller

"By working faithfully 8 hours a day you may eventually get to be boss and work 12 hours a day". ?- Robert Frost

"Far and away the best prize that life has to offer is the chance to work hard at work worth doing". -? Theodore Roosevelt

Warm regards, and thank you for being a WServerNews subscriber. No trees were killed in the sending of this message, but a large number of electrons were terribly inconvenienced. Please tell your friends about us. They can subscribe here:
http://www.wservernews.com/go/1307096257843

Stu Sjouwerman
email me: [email protected]

 

Admin Toolbox

Admin Tools We Think You Shouldn't Be Without

rDirectory's Community Edition is a pre-configured, easy to use, web-based directory and search engine that downloads in just minutes - and it's absolutely free!
http://www.wservernews.com/go/1323093725231

Insider. Outsider. With Centrify's detailed recordings of privileged user sessions, you've got a better way to see if outsourced IT staff are acting like insiders?or outsiders. View Demo.
http://www.wservernews.com/go/1323093652875

Tired of your Active Directory management tools? Centralize and simplify all Windows and AD management without scripting.
http://www.wservernews.com/go/1323093577803

Orion IP Address Manager - Get detailed visibility into IP address space usage and prevent IP address conflicts from taking down network devices.
http://www.wservernews.com/go/1323093448859

Free Service: Email Exposure Check. Find out which addresses of your organization are exposed on the Internet and are a phish-attack target
http://www.wservernews.com/go/1322990563515 

 

Webinars & Seminars

VIPRE Antivirus Business Product Demonstration - 12/6, 12/13

Looking for a security solution that doesn?t slow you down? VIPRE Antivirus Business combines antivirus and anti-spyware technologies into one powerful security solution for total protection with low resource usage. New VIPRE features include scalable multisite tiering and role-based access control. Join us as we demonstrate the many features of VIPRE Antivirus Business.

Register today!

Dec 6 at 2pm ET
http://www.wservernews.com/go/1322990602656

Dec 13 at 11am ET
http://www.wservernews.com/go/1322990615968

Free Desktop Virtualization Seminar

In this complimentary seminar, independent expert and desktop virtualization guru Brian Madden will update you on where the desktop virtualization market is in 2011, focusing on what?s real and what?s not. Spend just a few hours out of the office to take advantage of a live Q&A, peer networking opportunities and tons of valuable information.

Register today!
http://www.wservernews.com/go/1322990636296

 

Tech Briefing

HP LaserJet Printers Vulnerable To Attacks, Researchers Warn

Computerworld reported that millions of Hewlett Packard Co.'s LaserJet printers contain a security weakness that could allow attackers to take control of the systems, steal data from them and issue commands that could cause the devices to overheat and catch fire, according to two researchers from Columbia University. Printers from other vendors likely have the same issue, leaving users of those devices exposed to similar threats, the researchers said. The security researchers findings was first published by MSNBC.com earlier this week.

MORE:
http://www.wservernews.com/go/1322990695828

Network Admin Eats Humble Pie

An IT expert tries out an idea for configuring the company's file server, but instead confronts technical reality. This is a really good little story with a smart 'moral' we can all learn something from:
http://www.wservernews.com/go/1322990739234

IE 10 One Step Closer

Doug Barney reported in Redmond mag.com that Microsoft has been teasing us all with its vision of the mid-term future. We have sneak peeks at Windows 8, bold cloud pronouncements and then there is the browser.

IE 10 is meant to reinvent the browser much like Win 8 is meant to reinvent the OS. While Win 8 has a fundamentally different look and feel, IE 10's changes are more in the innards. The key move is to push HTML 5 in place of Flash and Silverlight. The idea is to have a single, open standard drive as a new wave of dynamic Web pages and apps.

Developers have been toying with what Microsoft calls a platform preview. These hunks of software have a limited UI, but the underpinnings are there to explore.

More at:
http://www.wservernews.com/go/1322990802250

Surprise! Certified IT Jobs Are Paying Less

Dang, not the kind of news I want to report, but it seems to be the case.

Bill Snyder at InfoWorld reported: "The market for IT jobs has not just bottomed out, it's stronger than it has been in several years. There is, however, a catch: The premium pay for jobs requiring the typical certifications that many IT hands labor for has continued its plunge and now is at the lowest point in 12 years. That news comes from a quarterly survey by Foote Partners, a consultancy that issues detailed reports on the IT labor market, monitoring some 2,200 employers and more than 120,000 jobs.

"Why the disconnect between a stronger overall job market and shrinking paychecks for certified techies? "Pure-play [tech] jobs are on the decline," says Bill Reynolds, a partner in the firm. Where once the majority of tech jobs were in technology companies, now many organizations whose business is not directly related to tech have many openings that require different skills, he tells me."

More:
http://www.wservernews.com/go/1322990896609

 

Windows Server News

Developing Mobile Apps For The Cloud

While cloud computing has become increasingly useful with more users accessing data via mobile devices, it?s important not to adopt mobile cloud without some careful consideration. This expert tip provides key factors to keep in mind before implementing this mobile technology: (RR)
http://www.wservernews.com/go/1322990949062

Local Storage For Virtualization: Will It Catch On?

Using local storage for virtualization is fashionable again. Check out this featured tip to learn how storage and virtualization vendors are utilizing local storage for a cost-effective alternative to shared storage: (RR)
http://www.wservernews.com/go/1322990999718

Technologies And Trends To Be Grateful For In 2011

New storage technologies, advances in remote graphics delivery and trends such as IT consumerization are reasons for desktop virtualization experts Brian Madden and Gabe Knuth to give thanks this year. Access this exclusive tip to see which other technologies and trends made their short list: (RR)
http://www.wservernews.com/go/1322991043687

Hidden Gems In Windows Server 2008 R2?s Resource Monitor Tool

Microsoft introduced a new performance monitoring tool in Windows Server 2008 called the Resource Monitor. But what not too many people know is that significant enhancements were made to the tool with Windows Server 2008 R2 (and Windows 7). Find out some of the new hidden gems in this resource monitoring technology in this popular piece of content: (RR)
http://www.wservernews.com/go/1322991099921

 

Third Party News

Access Control and Security Management

Meeting today?s strict regulatory compliance requirements and ensuring restricted access to confidential information can be challenging. Fortunately, this process can be made easier with a unified platform that allows you to manage security across your entire Windows network.

Download this free trial today and explore the ease of utilizing a single console to search, report, and recover security settings across multiple platforms. Key benefits include:

http://www.wservernews.com/go/1322991295953

VIPRE Business Service Release 1 Beta 2

GFI Software is very pleased to announce the availability of Service Release 1 (SR1) - Beta 2 for VIPRE Business and VIPRE Business Premium 5.0.
 
This beta release applies exclusively to the management console, and is currently available for download. The version number for SR1 - Beta 2 is 5.0.4943
 
We have included several bug fixes and improvements in this beta that are designed to improve the overall function, performance and usability of the management console.
 
Improvements:

Bug Fixes:

Beta Download and Support Information:

Complete details on how to obtain this beta and receive support can be found via http://www.wservernews.com/go/1322991323171 in the ?Release Statement? forum.

 

WServerNews FAVE Links

This Week's Links We Like. Tips, Hints And Fun Stuff

 

WServerNews - Product of the Week

New Free Tool - Real-time Bandwidth Monitor for Sub Second Device Polling and Interface Monitoring

Real-Time Bandwidth Monitor, SolarWinds? latest and greatest free tool, allows you to monitor interfaces on your network, see how much bandwidth is in use, or how much is traffic is currently on the interfaces. Now you can poll your interface as frequently as every half second. Set critical and warning thresholds to instantly see when usage is out of bounds. Monitoring a troublesome interface has never been so easy!

Download Real-Time Bandwidth Monitor