Friends in Tech » Security

Used Hard Drives

Mike McBride — Thu, 28 Aug 2008 02:20:51 +0000

I’ve been watching a debate over the last week, or more, on one of the email lists relevant to my current professional field, Litigation Support. It all started with a comment by a computer forensic vendor in which he mentioned that they routinely buy used hard drive on eBay and use them to practice and test their forensic tools, trying to recover whatever data they can. There has been quite a controversy over whether that’s professionally ethical or not, but that’s not really the reason for this post. My feeling on whether that’s ethical or not is irrelevant.

My concern is much more basic than that. I just thought maybe you all would want to think about where your old drives are going when you decide to get rid of a computer! Even if you reformat the drive, much of that data can be recovered with the right tools, and that’s assuming the recycling place you dropped it off at actually takes the time to do the reformat. We’ve all seen too many stories of drives not being wiped at all when they’ve been resold. Surely we all take steps to prevent that, right? On the other hand, how many people do you know who do a quick format and assume it’s clean? It’s not. Do some research, ask around, find a secure way to wipe that drive, or, as one of my listmates suggested take the ultimate secure HD tool to it, a 12-gauge shotgun.

What other tools do you recommend to your users? Hammers, screwdrivers to the plates, metal shredders? Let us know!

Microsoft SteadyState 2.5 in beta.

Andy Helsby — Wed, 28 Nov 2007 23:57:19 +0000

Microsoft’s SteadyState 2.5 is now in Beta and supports Vista. Admittedly the application is in Beta but for those of you who need the ability to lock down a pc so that any changes made by users get removed on reboot, then SteadyState is well worth investigating. This application was last mentioned back in July, but the new version has recently been released.

WRT54G Hacking Book and Website

George Starcher — Sun, 01 Jul 2007 17:07:41 +0000

Our Friendsintech members Paul Asadoorian and Larry Pesce from Pauldotcom Security Weekly have their new book and the companion web site out. If you have a linksys WRT54G and wanted to know all the cool tricks you can do with it then check out their book and website. Better yet, get two or three routers cause you want to be hacking them up after you see all the things you can do.

Links Mentioned:

Tags: Hacking, WRT54G, Paul+Assadoorian, Larry+Pesce

FiT Child Safety Online Flier

George Starcher — Wed, 16 May 2007 09:39:52 +0000

Hi Everyone!

It is the return and refresh of the Friends in Tech Child Safety Flier. Feel free to share this flier with anyone whom has kids and is concerned with online safety. We have links for everything from blogging, cyberbullying to advice for parents. We managed to toss in a couple of software and podcast picks that are family friendly. The flier looks great printed out as well as the electronic PDF. Please respect all the sites we cover and do not modify the flier if you share it. FiT nor any of its members derive any financial benefits from this flier or its mentioned sites. We are simply tech geeks with children, nieces, nephews and young friends we want to be safe and happy.

Links Mentioned:

Tags: FiT, Child, Safety, Online, Cyberbullying, Podcasts, Dr.+Floyd, Techsavvygirlz

Another Free Antivirus Option

George Starcher — Thu, 03 May 2007 11:31:18 +0000

I like some of the free tools from eEye. In the process of checking the site this week I found they are offering a security suite free for a limited time for Windows home users. They combine antivirus, intrusion detection and antispyware in one program. This saves the memory and resources to run multiple different tools.

Links Mentioned:

eEYE Blink Personal Edition

Tags: eEye, Antivirus, Antispyware, IDS, Security+Suite

Ever Been Deposed?

Mike McBride — Tue, 10 Apr 2007 02:08:46 +0000

As part of transitioning to my new responsibilities I’ve been spending quite a lot of time reading up on Electronic Discovery best practices. One of the themes that I’ve been seeing over and over again is this idea that anytime there’s impending litigation against a company, you have to immediately get a key IT person involved. Someone who knows the infrastructure, who knows where everything is stored and can testify to that as part of the discovery process. You have to have them implement a “legal hold”, which basically to recycling backup tapes or doing anything else that might destroy data relevant to the litigation as soon as you become aware that it is impending. Again, you need your key IT people to do this properly.
Anyway, not to bore you with too many legal details, (those are now my problem, not yours) but in reading about all the contact needed with key IT folks, both in implementing a hold, and having them present at discovery depositions, I wondered why, if this is a legal best practice, I hadn’t ever heard anyone in the IT community really discuss having been through this sort of scenario? Shouldn’t Sys Admins be familiar with the concept? Isn’t it odd that of all the Sys Admin types I know, I’ve never heard one talk about dealing with electronic discovery from this end of the situation? I’ve heard plenty of folks talk about retention policies, which are part of the whole area, but nothing about how those policies come into play when your company is party to litigation. Are there legal reasons to not discuss it at all, or is it a much less frequent occurrence than my research would lead me to believe?

So, I want to know. Have any of you been involved in a “hold” situation, or had to appear at a deposition to describe what electronic storage is available and can be searched? Leave a comment, tell me about it, and be sure to change names, dates, places, etc. Wouldn’t want any of you to be back dealing with the lawyers again. Even if you’ve never been involved in something like this, tell us what you think about it. Does your organization have good policies in place? Are you aware of what to do if it happens, has anyone identified who the key people are ahead of time? I’m curious to see how these best practices are playing outside the legal community.

Tags: ElectronicDiscovery, Litigation, SysAdmins

Upgrading a server – what would you do – part 2.

Andy Helsby — Mon, 05 Feb 2007 01:58:59 +0000

In my previous post I posed a problem where all the users were in the domain admins group and asked what dangers this could pose. The responses included the fact that removing people from the domain admins group could cause issues with programs running on the local desktop if the previous setup relied on the administrative rights to allow users to be an administrator on the local pc. This is a correct statement, but there is another gotcha that has yet to be revealed.

From my analysis of the network (after the gotcha was revealed) it was discovered that the previous administrators had been lazy and actually added everybody to all of the groups in the domain so they wouldn’t have to worry about people not being able to do things. I removed them all from the domain administrators group to lock down security (they would need to be in the power users for some old applications to work)
So now you know all the relevant details that may lead you to the gotcha, what do you think is the problem?

Upgrading a server – what would you do?

Andy Helsby — Sat, 27 Jan 2007 19:44:13 +0000

A couple of weeks ago I had the experience of working a long weekend to upgrade a clients network from an old NT network to Microsoft’s Small Business Server 2003. The actual upgrade went fairly smoothly but something arose that I thought would make a good puzzler for the Friends In Tech Website……

You come to upgrade a domain from nt4 to sbs2003 and do a swing migration. This transfers all the existing users, groups, email address’s and configuration to a new hardware platform with the minimum of downtime. The old network domain was previously set up by a different IT company so you thoroughly document the setup prior to the upgrade. As part of this routine you notice that all the users are in the domain administrators group. You know this is a very bad idea and plan to remove the users from this domain administrator group.

Judging from the fact that all users are in the domain administrators group, this could imply a certain procedure for how users were setup in the past. What could this procedure be, how risky is it to remove users from the domain administrators group and what unforseen consequences could this have?

Please comment to this post or in the Friends In Tech Forums and an answer will be posted after a week and a clue given if nobody gets it. The idea of this post is to stimulate discussion, brainstorm ideas and warn others of a potential pitfall! You may want to subscribe to the comments feed to see what other suggestions have been made.

How to expect the unexpected when working late at a client.

Andy Helsby — Sun, 17 Dec 2006 22:18:02 +0000

I had a fun experience when working at a client site on Friday night – all names have been erased (apart from mine) to protect the guilty……

A customer needed to switch to a dsl line for their internet connectivity which meant a disruption to their website, incoming email and outgoing internet so it had to be done out of hours. As it also involved changes to externally hosted dns it was better to do it at a weekend so that by the time users came back to work on Monday all the dns servers would be returning the correct data.

I picked up the key for the building earlier on in the week and agreed with the customer that they would not set the alarm that night (I’d be arriving shortly after they would have left for the weekend) and I’d just have to arm it when I left.

Friday night I turned up at the client site, unlocked the front door and hear a beeping noise coming from the alarm control unit – this was not going to be a good start to the evening. I fumbled in my coat pockets for my phone and also for the customers cell phone number on a piece of paper to try and get the code before the alarm went off – those alarm sound bombs are painful. I literally dropped everything and ran out of the door to where I could stand without my ears hurting. Fortunately I still had the key in my possession and the phone was in my jacket pocket (as I hadn’t been able to get it out in time).

I called the contact number for the client and received a “hello” and then the connection died. When I redialed I just received the voicemail so I then called our office to see if someone had a home phone number but they didn’t. In the meantime the client calls me
back but each time I call them I have to wait ages for them to answer. By the time I get to speak with them the alarm has stopped ringing but I didn’t want to open the door in case it set the alarm off again. The client gives me the code to enter and I go inside, reset the alarm and then hang up the phone. Just as I do this the police show up! I explain what is going on, show them that I have the key to the building so I’m not a burglar and have to produce id for him.

The cop leaves and I go and apologise to the cat that must have been in
REAL pain (turns out there is actually two pet cats in the building), and
start work. As I have to sit on the floor as there is no desk space I
spread my stuff out and the cats promptly come and sit on the pieces of paperwork making it hard to read the various passwords and details needed to complete the job. The job was actually a bit more complicated than I expected but I obtained some pdf’s from the manufacturers website and was able to move their internet connection across ok.
A very memorable evening but there are several things to learn from this.

Ensure you ALWAYS have the alarm code for a customer site if working out of hours – do not rely on them turning it off before you arrive.
Ensure you have at least one contact number for a client – preferably two in case the first does not answer.
Carry some id with you – a company business card is good to prove that you are not just a member of the public – although I didn’t have a business card to hand (they were all in the computer bag inside the building) I had driven the company car with all of the advertising stickers on it.
Cats love to sit on papers spread out on the floor – try and organise a desk to sit at when working – it can also get uncomfortable sitting on the floor for long periods of time.
If you are allergic to pets check that customers don’t have animals roaming around the premises (especially if the customer is a zoo!)
An external source of internet connectivity is great for testing and looking up results on the internet without having to revert to the customers network (which may or may not be working properly at the time)

New Symantec worm on the loose.

Andy Helsby — Sat, 16 Dec 2006 13:24:08 +0000

EEye Digital Security have announced that a worm is attacking Symantec hosts and called it the yellow worm due to the obvious colouring of the software. Symantec have had a patch available since May 25th this year but the patch has not been widely installed. This is probably due to the fact that there is no easy auto update for the software from Symantec – Liveupdate does not download patches (only virus definitions), there is no obvious mailing list to sign up for patch release information and they have not made a patch available for (slightly) older versions of the software meaning that a company has to upgrade to the latest version (10.1 from 10.0 – not a free upgrade unless on support) to obtain a patch and even then the patch has to be applied afterwards.

Symantec, you really need to make your upgrade process less painful, have a well publicised mailing list (and web page) of patch releases and have an update mechanism built into the product.

Tags: Symantec, antivirus, yellow, worm, EEye