Behind Every Good Admin, Should Be a Good Woman

Because we'd probably starve otherwise--well I would.

Spicey Lemon Chicken, con White Rice con Green Beans, and it's freakin' good. Yeah it's almost two and I am barely eating my "lunch," go figure. Thanks for my tasty dish dear, when I get home I'm going to Scout you though.

The Mickey Mouse by Apple!

Warning: This is probably a rant.

I hardly ever keep up with new things Apple spits out because I don't care. My network consists of all PC machines and servers, as do most companies. But when I do come across stuff that Apple puts out, I sometimes feel inclined to say something about it. Not so much because the technology sucks totally, but because I just don't like the Apple user attitude and I enjoy chopping them down to size. These mostly consist of people that still think there aren't any viruses for Mac OS X. Those that don't think any of their cats can't get mange or the rabies, sorry snow leopard, you can get AIDs.

What's the next Apple product to discuss? It is the "Magic Mouse." I've come to term it the Mickey Mouse, since the name "Magic Mouse" makes me think of Disneyland and Mickey. I so bet Mickey was a "Mac" and the mop was a "PC", you can tell because he's doing all the work and Mickey is prancing around acting like a moron, also he's on the Right.

I won't go into what the mouse is here because their website explains it all. However I will go into what it looks like for comic relief. It looks like a Maxi pad, or maybe an Always pad, I am not sure yet, it depends how much protection this mouse offers, but I doubt it doesn't offer much overnight protection.

Let us compare:

In the above images I was able to have the official Apple hand model demonstrate what the Maxi Pad would look like, of course we had to find an appropriate hand model to hold that big pad to make it look smaller to the public. Can you tell the difference? I couldn't either, not without labeling it, so I labeled it so you don't get confused either. I mean really, I'm married, what if I get sent to buy some pads (again ._. ) and I come back with a Magic Mouse and my wife gets mad at me? It will be all Apple's fault. That's enough of the non ergonomic design flaws I've pointed out, let's talk about the basic "intuitive" flaws now.

Apple states: "Now we’ve reached another milestone by bringing gestures to the desktop [...] that’s unlike anything ever before."

Lies! Let us introduce Apple to touch pads. What's really so different from touch pads? They too use "gestures" (a fancy way of saying, moving around your finger) and some even let you scroll left and right too. You can click by tapping or click by using the convenient buttons, look:

There's even detachable ones that you can still move around. Not to mention the Tablets that have nice pressure sensitive features and mice to use as well that require no batteries or power at all. All Apple is doing is reinventing the wheel, the touchscreen on the iPhone existed prior, the touch anything existed prior to Apple's latest trends. Even the color white existed before Apple.

Fail.

Macware for Mac Security!

It is interesting that more and more recently--well hold that thought, maybe now I am caring more about what is going on with Macs than before? Anyway, more "security" focus is being given to Macs, why? We know why, experts have been saying why for a long time.

"Macware for Mac Security"

"We hope Mac users across the globe enjoy the variety and value being offered in this bundle."

The Mac Security Bundle contains the following programs:
* Macware WebGhost5
* Intego VirusBarrier X5
* Micromat TechTool Pro 5
* Absolute Software Computrace LoJack5
* Intego ContentBarrier X5
* Intego NetBarrier X5
* Smith Micro Spring Cleaning
* JoeSoft Klix
* Intego Personal Antispam X5
* Intego FileGuard X5
* Intego Personal Backup X5
* MOApp MyWallet

I guess Justin Long on Mac vs PC commercials just gained a little more weight with "Bloatware." I just find it annoying how Apple just won't come out and state the obvious, "we're sorry people, our commercials and mass marketing campaign were very misleading."

On Computer Security Concepts & Practices

[Disclaimer: I do not claim to be an expert on IS or IA. All information provided are for informational purposes and as a foundation to an opinion rather than any form of academic reference. Please use the references that are provided to make further use of the information contained therein. However experiences in the field of networking and computer security in my specific environments have prompted me to document the information in this post.]

Security. It's on people's minds when surfing the web, using a network or concerned about privacy. It permeates our communication, transmissions, and even some daily routines. On the computer spectrum, since in most cases the end-user is running a Windows Operating System it is reasonable to conclude, that it at least crosses every computer user's mind at one time or another, "am I safe?"

I think there are common misconceptions thrown around on forums, social networks and among PC/Mac flame wars. Often the terms security, exploits, vulnerabilities etc. are thrown around often with loose meanings. I've often seen, 'if the PC users would switch to Mac, there would be a lot less problems with [insert exploit here]." Now this is not to say these comments are coming from security experts and those that should know better, at least I hope not. But judging by the comments I've witnessed, they seem to be misinformed people speaking to a misinformed audience.

First of all, why are there so many vulnerabilities constantly being found on a Windows OS? Well instead of simply looking at the way Windows operates, let's examine why a vulnerability exists in the first place. But if we're going to talk about vulnerabilities we will definitely need to talk about exploits right? And if we're going to talk about exploits, there would be reason to speak about payloads! We know vulnerabilities exist. We know exploits take advantage of those vulnerabilities. We know that the payloads determine how severe the vulnerability eventually becomes. So instead of talking about Windows containing "buggy or flawed" code or that it has a large market share or whatever other reason is often given, let us talk about more of the principles of security than the results of vulnerabilities, and perhaps it would give us a better understanding of why they exist anyway.

From my personal research and observance, there are three main divisions that in one form or another involve security; Computer Security, Information Security, and  IA (Information Assurance). Of course we as computer users are primarily concerned about computer security, though it is not unwise to also gain a little bit of knowledge on the other two. For two reasons: the first, computer security is actually a branch of IS, and second, the other two existed before or at the birth of computer security. So even though they are not the same thing, some fundamental things are shared among them either slightly modified or for a different purpose.


Let us first look at Information Security. Information security has existed for as long as any sense of "privacy" in humans has existed. Whenever it was that the first human breached trust, violated someone's privacy and exploited the information, you can bet that people began to worry about security. This really became apparent when the mechanism of writing became a common tool to use in  communication. Then when a mechanism for transmitting these messages were used (smoke signals, runners, coaches, letters, electronics etc.,) the need for security was obvious. It was much more evident throughout history of its importance when wars began. Intercepting information, breaching physical locations, and interrogation only magnified the need for security measures.In order to avoid some obscure history lesson, the point is, "security" has existed a long time and from the beginning there has also existed "vulnerabilities" and "exploits" for such measures. People that implemented their forms of communication, information sharing and security did not take sides in flame wars, "my smoke signal pattern is more secure than yours!" Rather as computer security enthusiasts should be, they focused on the truth, all security is penetrable.

An example, would be the well known Caesar cipher. I say well known because I think at one time or another, as children we've all seen "decoder" items or toys in cereal boxes or a box of Cracker Jacks, those were based on that particular cipher. However given its simplicity, this way of protecting information in that environment was possibly very effective. The reason I say "environment" is because of the type of people he was trying to keep out of his information. Did they know the cipher? Probably not. Was it a highly common thing among those he was protecting information from? Not really. Some scrambled letters could have easily looked as a different language and have been unusable to his enemies.

Even though it is a primitive form of "encryption" an equally primitive form of Brute Force attacks were its exploit to the vulnerability even back in 50 B.C.! Technically speaking, if you came across such an encrypted message in our day, you'd understand it was encrypted. You wouldn't know immediately though what encryption nor what algorithm was implemented, but you could guess. In this modern age, we have a wide range of access to free information, it would take a relatively short time to figure out what sort of encryption is used on a message. Really then, the principle has not changed. It is not a matter of how but when. Given enough time, anything can be cracked, but fortunately for most modern encryption, time is something humans do not have. So is the vulnerability gone? No it is not, but instead it has been made very difficult. So do any other vulnerabilities exist with modern encryption? Yes. One need to look no further than the software that makes use of the encryption, or better yet, the users. It has been proven often that social engineering is a formidable foe and it will continue to be so until humans are no longer prone to make mistakes, ever.

[For further insight on the discussed subjects see the following links: Encryption, Introduction to IS, and Software Security Engineering by Microsoft ]

There of course is much more to the workings of IS (e.g. hardware, physical, software) but is well beyond the scope of the point in this post.

Note: Information Security is modeled on three main components, which are discussed under the next heading because of their close relationship.

Now let's look at Information Assurance. With IS, we were a lot closer to the security of information, but with IA we are actually a bit higher and further from operation. This is because IA takes in a broader sense of risks that not only involve security, but availability, privacy, integrity and authenticity. There are actually a few more areas in which IA's scope manages but for this article, we do not really need to touch on them. Since it is closely related to IS, I will use the CIA model of IS (not the government agency) to display a common core of components.

The "CIA" model consists of Confidentiality, Integrity and Availability. These are the main principles adopted by IS but also instituted within the IA model of principles, as I said, we are further back from the picture looking at a broader sense of information.

The basic functions of IA is to assess the object that is being protected. Remember, not only protected in a security format, but also from disaster, manipulation and availability. (Privacy, Integrity, Availability.)

Once it is decided which assets are to be protected, it is next determined what possible risks exist, ultimately worst case scenario.

When such an evaluation is done, the IA personnel will provide not a solution simply to "proof" the information from any of the above already existing vulnerabilities, but to manage how to best protect the information with the least TCO. Not only financially, but legally (broad sense) and effectively keeping availability.

If you notice however, why isn't an effort to "100% proof" a system performed? Because quite frankly it would be unreasonable to do such a thing. Not only would it be unreasonable, but consider the resources it would take at the expense of TCO; and yet the system would still prove to be penetrable. Furthermore, have you observed a system that is vulnerability proof? It then seems logical to conclude that based on these two core principles, our argument should not be on who has the most "vulnerabilities" or "exploits" but rather on providing and making use of the security and other resources immediately available!

For further reading, the following links may be of interest: Department of Defense IA Implementation, DoD Intructions, Bella-La Padula model, more on Computer Security models. Here is a paper on general security models, including the previously mentioned at crazylinux.net

And then there was Windows. After these two brief non-exhaustive presentations, it would be foolish to sit on a particular Operating System because you think it is "more secure." You are lying to yourself. Rather you should be sitting on an Operating System because of your observance of how closely the above principles are applied, but first of all with yourself. Whether at the developer level, or at the end-user level, security measures can be implemented to a respectable degree that would make even the would-be hacker nod their head in respect. Even though still penetrable, respect for security as a whole would protect you in most cases. After all, it was respect for security that moved the above principles to be developed and implemented.

Though, back on the subject of the Windows Operating Systems, again, why do they have vulnerabilities? Is it simply because the code is "bad" or because another OS does a much better job? Or could it possibly be because it is well known? Is it because it is a target? Is it because the weakest links are easier to predict than are the encryption schemes? I believe these questions should provoke objective thinking on the subject on an individual basis rather than uninformed generalizations.

The fact and theme of this post remains the same, from the ancient days of security, though it has evolved over time into different forms, the reason it has had to change has never changed itself, vulnerabilities exist in all of them and unless people cease to look for them, they will always exist. The more services are accessible, the more risks open up for breaching. The more exposure, the more chance there is. The more we think we are "safe" the more insecure we become.So again, it is not a matter of if or how, but a matter of when.

Charlie Miller on Mac's Security

Here is a couple of more sources to further show my point's validity. Don't be fooled by their marketing, Mac OS is setting itself to get owned further as their share increases.

http://blogs.zdnet.com/security/?p=2941 Charlie Miller explains exploits in Mac OS

http://www.tomshardware.com/news/hack-windows-security-snow-leopard,8704.html Charlie Miller convinced

Interesting how this supports what I said in the previous post:

"they are indeed setting up to crash and burn when they jump into the lake with the Big Fish who have been swimming with sharks for over two decades."

The question we should ask is, why were these exploits so easy to use? It's a good question, because the answer reveals Apple's pretense and attitude toward security flawed in principle.