Are you planning to attend any tech conferences in 2009?
Total Votes: 316
You can’t run a successful project with bad estimates, any more than you can build a solid house with faulty bricks and lumber. These simple steps will help you filter out the bad numbers you get today and improve the numbers you get tomorrow.
Projects run on estimates. You either have to provide estimates of things such as how much effort your task will require or you will need such information from others. Unless you’re in one of a small handful of roles, you will surely come to rely on estimates of others, even if it’s just to frame your own estimates. And if you’re a project manager, the estimates of others are probably all you have to work with.
Overall, project estimates are only as good as the individual estimates associated with the component tasks. But as much discussion as there is on the estimation process, there isn’t a great deal of information on getting better estimates from others. Here are a few ideas to help you see this aspect of estimating more clearly — and to help you avoid leading your project astray before it ever starts.
Note: This article is also available as a PDF download.
It is true: History does repeat itself. I can’t tell you the number of times I’ve seen developers give an estimate of two days and actually take four. There’s nothing wrong with that, because there was probably four days’ worth of work to begin with. The problem is that I also see people in meetings repeatedly believing them. If it has taken twice as long as the estimate the last five times an estimate was given, why would anyone think the estimate will hit this time? Beats me, but some people continue to fall for it. Unlike the stock market, past performance can be an indicator of the future.
Learn the justification for an estimate. If you ask why they think it will take two days, and you get a reasonable task-by-task break down of the two days’ work, two days may be right on the mark. But if your developers just shrug their shoulders, it may be time to worry. This also provides a great opportunity to assess their assumptions.
Push back. Ask questions. Project managers seem to do this pretty naturally, but challenge the developer or development team to explain why they think it will take so long. If they can justify their estimate, at least you will know that they gave it some thought. If they can’t, perhaps they should be thinking about their estimate some more before you start relying on their figures.
Don’t be surprised if the estimate actually goes up. It would not be the first time I’ve seen a discussion with developers expose previously undiscovered project tasks. While not great news, it’s still better to find out about this sooner rather than later. Left hidden, those tasks would have surely destroyed the timeline when they came to the surface and jumped onto the critical path.
Okay, you know your developers are always missing their estimates, but by how much? If you aren’t measuring it, you really don’t know whether you have a big problem — or maybe don’t have a problem at all. This also ties into the history suggestion above. How long does it usually take? You don’t know unless you track this information.
Metrics also go a long way toward improving estimates. Like any process, you can’t improve it if you don’t measure it. Unfortunately, a deep dive into this topic would be an entire article (or two) in itself. But if you don’t have a clue where to start, just start capturing expected date versus actual delivery date. You might be surprised by the patterns that develop.
This is for those who just can’t come up with a time estimate for the work. First, try helping them break down their work into smaller, more manageable, tasks. Next, you may find it useful to use a simple bracketing technique to help the person zero in on the figure that is appropriate. “Is five days enough time?” “Can you do it in less than 10?” Continue in this fashion until you get a figure that everyone is comfortable with. Of course, you should be challenging and asking for details throughout this process.
When you’re hiring a builder, they say you should get several estimates, throw out the highest and the lowest, and then go with the one in the middle. There might be something to that approach. When working with a team, you’re probably getting your estimates from the team’s point person — a lead developer, for example. While this is efficient, it may add some risk to the accuracy of any estimate you receive, especially if there is a wide variance in the estimates of the individual team members. You may be getting the result of a faulty team consensus, a blatant falsehood to avoid having to face some development reality, or an estimate flawed by an innocent miscommunication.
If you have reason to suspect an estimate may be off, or if the team has a bad track record for this sort of thing, a second opinion may be in order. Seek an informal read from other members of the team. If you run the team estimate past an individual developer, and he wrinkles his nose at it, you may have some more digging to do. If everyone is of a like mind, you probably have as good a number as you can expect.
Run your figures past someone who might have experience with your type of project. If this person is not on your project, all the better. Perhaps you’re a sucker for good news. Perhaps they are telling you what you want to hear. An objective third party is exactly what you need to free you of your bias and give you a clearer view of reality.
You have captured task estimates, and you have tracked actual. From this, you may have learned that certain groups always underestimate by 25 percent. That is certainly good to know, but don’t let the value stop there. Provide feedback to the team members. Help them identify patterns in how they estimate and challenge them to find the root cause of their bad estimates. Generally speaking, people really do want to do a good job, so provide them the tools and a few suggestions. Your folks will be able to take it from there.
Penalize the bad estimate, not that a task estimate is too long. When estimates are shortened, it’s generally because that shorter number is what’s expected. That is where the “If all goes well, it will take…” comes from. Be serious. When was the last time “all went well”? There’s nothing wrong with qualifying an estimate, but adding an unrealistic assumption as a way to give a bad estimate only hurts the project. You want to drive toward behaviors that give better estimates. Celebrate when estimates are hit. When estimates are missed, you don’t need to tar and feather the offenders, but you can treat it as a remedial education opportunity (the very act of which will be a penalty of sorts).
Be careful about rewarding beating an estimate differently from hitting it. If you create the situation where it is better to beat an estimate than simply meet it, you will create an incentive for overestimating.
Using the correct rewards and penalties goes a long way toward establishing the right culture, but what is the right culture? Certainly, it’s one in which those providing estimates feel safe in providing accurate information as opposed to providing the information they believe supervisors want to hear. However, it must also be one in which everyone strives to improve the quality of their estimates and the notion of providing a bad estimate is as bad as providing bad program code. Managers must also respect those providing them with information, once those people have proven themselves. Ultimately, if you can get peer pressure to “manage” the estimates, your job will become considerably easier.
You can’t run a project well with bad estimates, any more than you can build a house with faulty bricks or lumber. Fortunately, you don’t need to do everything yourself (nor could you) to get estimates you can trust. Exercising the simple ideas above will help you filter out the bad numbers you get today, improve the numbers you get tomorrow, and generally make your life a whole lot better — at least as far as your project is concerned.
Many businesses are turning to video conferencing as an effective way to reduce travel costs. If your organization is in the market for a teleconference system, Jay Rollins suggests taking a look at Cisco’s new TelePresence suites.
—————————————————————————————–
Cisco Systems announced this week the new TelePresence 1300 Series suites, which promise to put the unbelievably good teleconference system within reach of more companies. If you have never seen a full-blown TelePresence setup, it is worth the introduction.
In the suite that I saw, Cisco set up several high-definition TV screens, a high-end audio system tied to its VoIP products, and HD cameras in each room. Cisco looked at every element of the solution to try to make the TelePresence experience as close to having a face-to-face meeting as you can get. Special backlighting behind the screens help diffuse the light so it appears the same way on either end of the conference call. Even the furniture plays a roll: Half-moon conference tables appear to be full-moon tables once the sessions become live. Camera setups and other elements of the interaction management make sure that people are all looking in the same direction when someone is speaking.
For example, you have three users on each side of a two-way conference: one group in Boston and the other in San Francisco. If the user on screen one in Boston talks, everyone in the same room in Boston would look right, and everyone in San Francisco would look left, just like if you were sitting across the conference table from them.
The screens are so large and clear and the spacing between the user and camera is so precise that after a while, you really begin to feel like the other party is right across the table from you. Freaky.
This latest release of the suite comes in at around $89k, and although it doesn’t have all the bells and whistles of its $300,000+ big brother, it is a viable solution to help cut travel costs. Every excuse you can think of as to why you need to travel for a meeting starts to melt away. Even the telecommunications costs that used to make these technologies cost prohibitive are now manageable with HD TelePresence collaboration conferences being connected via straight T-1 connectivity.
Cisco’s investments in WebEx are starting to make more and more sense, as the direction of the TelePresence products continues to evolve with a focus on collaboration as well. New additions and future enhancements are going to lend themselves to more interesting teleconference experiences. Desktop sharing and collaborative applications will allow teams to work more effectively across great distances. In addition, these suites are not just for multi-way conferences; you can also use the studios to produce HD recordings for meetings, training sessions, etc.
I am not sure the price point makes this technology widely adoptable for my current company, but it is getting closer. I was always a big fan of face-to-face meetings, but ever since I saw the full-blown TelePresence suite in action, I have been hard-pressed to find reasons not to have virtual meetings.
Cisco has built these suites in most major cities, and companies can rent them out on an hourly basis. If you have an opportunity to try it out, I highly recommend bringing your CFO in to see the suites in action.
Research indicates that the CIO’s role as the functional department head is becoming less important to organizations, especially SMEs. Jay Rollins offers CIOs advice on how to transition to being more of a business strategist.
—————————————————————————————–
CIOs are increasingly asked to be more strategist than functional department head. In a small and midsize company, this can be very challenging. CIOs are expected to be: a technology expert who focuses on operational excellence, a dynamic leader who can lead change throughout the organization, and a business strategist.
If a CIO comes up the ranks through the IS track, her comfort zone is in the functional realm. CIOs who focus on the functional area know servers, software, applications, databases, telecom devices, etc. More importantly, they know how to operate and manage them efficiently and effectively. This works out brilliantly if you need information about the next version of server operating systems, the impact of open source, or what servers to buy to get the most megaflops per dollar. But according to studies and research, such as CIO.com’s State of the CIO 2008, the functional focus is becoming less important for the CIO role.
Many CIOs have abilities to transform an organization. CIOs can see how a new technology can help their companies (and not just the IT department) operate more efficiently and know how new software applications can revolutionize how their companies operate. Streamlining a transaction process or facilitating huge productivity improvements and doing it successfully require four important skills: evangelical, project management, people leadership, and end-state visioning. Important to the organization? Absolutely. But that same research also suggests that this role is becoming less important to organizations.
Business strategist CIOs focus more on external customers and partners to work on introducing new products or businesses to the market or new technologies that facilitate internal sales and marketing organizations.
As these differentiations have arisen over the years, I have found that the functional and business focuses are not mutually exclusive — especially for the CIO in an SME. Maybe larger companies can afford to hire just the business strategist CIO or the transformational CIO, but for the SME, many times, this is just not an option.
I believe that the functional focused CIO is becoming less important even in the SME. Companies in this stage of growth require less of a systems expert and more of a process or business expert. Transformational tasks are extremely important as companies start growing quickly. Economies of scale and efficient operations of core processes can be early differentiators in these companies. A CIO who can understand these internal processes, execute to a plan, and lead the change and transformation is vital.
Other key qualities are understanding external customers and establishing strong relationships with not just IT vendors but suppliers with a focus on new lines of business or products that can be taken advantage of. CEOs rely heavily on a CIO who can bring system and process knowledge to the table to help generate ideas and create new relationships. You don’t have to wait for the CEO either; SMEs typically launch in new industries or by developing new products. Many times, these companies focus on building custom systems that help this particular company do its business. These same systems can be commercialized and sold outside of your organization. If the system addresses a process for your industry, know that it is not a strategic differentiator. This is the time in the product life cycle when you can make the most out of your system, but it is only a temporary advantage; it’s the perfect opportunity to step in and make bottom line contributions to your company.
Even though it will not be easy, many times, it can and should be done. In an SME, the trick is getting your head above the flood of issues that keep dragging you down to the functional focus that you still need to address.
Know how much time you are spending on functional issues; look at that time in relation to the time you spend being a transformational change agent or a business strategist; and then question whether you should spend that much time focused on functional issues. If your answer is no, look to delegation or outsourcing it to partners, but always focus on the functional issues with an eye toward fixing the issues for longer term supportability. You should also make time to focus on the areas that are becoming more important to your company.
As companies get larger, the business focus gets rewarded more than the functional focus. CIO.com’s State of the CIO 2008 found that a business focused CIO earns “44% more than the function heads.” So make time to focus more on strategic areas — it will pay off in the long run.
IT projects can be a massive undertaking, with multimillion dollar budgets and an army of project staff and consultants that rivals a small company. With so much riding on the outcome of these projects, it’s imperative that you stack the decks in favor of success. To that effect Patrick Gray offer these five tips, garnered from my experiences working with companies around the world.
One of the most important functions of an organization’s IT department is its ability to successfully implement projects: fixed duration activities with a specific result. Most IT leaders have realized that the commodity functions of IT, like keeping the network up and the servers humming are now a baseline expectation, and projects are increasingly becoming how they are judged on their success or failure.
IT projects can be a massive undertaking, with multimillion dollar budgets and an army of project staff and consultants that rivals a small company. With so much riding on the outcome of these projects, it’s imperative that you stack the decks in favor of success. To that effect I offer these five tips, garnered from my experiences working with companies around the world.
From the technical nuances of the software and hardware involved to complex interactions between affected business units, most IT projects are awash in details. It’s easy to become mired in these nuances, and forget that, at the end of the day, every IT project is tied to a business objective. That objective might be straightforward, like implementing server consolidation to cut costs, or it may be more cerebral, like implementing a business warehouse to provide detailed market analytics and help your company enter a new market. Whatever the objective, if you keep the business goals at the forefront of every discussion and frame any technical or project discussion within them, not only are you more likely to meet the stated objective of the project, but the initiative will be more palatable to the non-IT staff that are affected.
To tie all levels of the project back to the business objectives, see one of my past blogs, Is Your Project MAD?
Most business software applications assume a corresponding process. From a complex ERP system that dictates a recommended approach to everything from issuing invoices to running payroll, to online publishing tools that expect a defined series of steps to be followed, you often buy into the process associated with the software just as much as the software itself. If you’re cognizant of this fact, you will expect and plan for process changes as you implement the software, rather than applying layers of metaphorical duct tape and bailing wire to a package in order to support a “my way or the highway” approach that has killed many a project. During the software sales cycle, the process and “way of doing things” that the software assumes are just as important as the pretty screens and fancy features. Thinking you can drastically modify one of the other is a recipe for disaster.
Nothing saps energy from a project like a drawn out decision-making process. When fifteen layers of management must be consulted, countless meetings held and a bevy of naysayers brought in whose only function is to quip why “that will never work,” you are destined to failure. Before starting a project, define how critical decisions will be resolved, who has decision-making authority and what the timeframe is for critical decisions. It is better to make an imperfect decision that moves the project forward today than to spend months vacillating and pontificating while time and money fly out the door.
Similar to keeping business objectives in mind at all times, in the beginning stages of the project, determine what objectives are critical for each phase of the project. Some objectives are more important than others, just as some scope items may be absolute requirements while others are nice-to-haves. By making these decisions early, it’s clear when the project moves from one phase to another, or is at risk of failure since the criteria are known in advance and not subject to frequent revision in later phases of the project. Defining exit criteria for each phase also avoids the tendency to rush initial phases of a project and roll work into a future phase, an attempt at paying tomorrow for what you can’t afford today.
The earlier you can define your “ruler,” the more likely you are to make calm and reasoned decisions that can be relied upon during the heat of battle later in the project. This also provides a benchmark of how closely a project is to the original objectives, avoiding the risk of changing scope and compromising requirements to the point that you successfully implement something that does not meet the right objectives.
Implementation partners are a critical piece of any IT project, perhaps even more so than the software and hardware at hand. Choose a partner that has a good organizational fit with your company, experienced people and high-quality references. Ignore endless trumpeting of a particular “proprietary” methodology (they’re all pretty much the same), resumes of people that might soon become “unavailable” and glossy proposals that spend hundreds of pages talking about how great the implementation partner is, rather than detailing how they will help solve your problems.
If you have any doubt, there is no shame to hiring an external entity to help vet potential implementation partners and the modicum of time and expense is obviously preferable to a costly switch down the road.
“I’m stressed out. The environment around here is bad, and it’s getting worse. I’m concerned that the economy’s going to take a long time get back to normal - if it ever does.”
I hear a lot of comments like this. But in this case, the speaker is a client who’s actually a successful leader. She works in an organization that seems to be bulletproof when it comes to the recession’s effects. There seems to be no risk to her at this stage. “So,” you might ask, “why is SHE concerned?”
I think there are several, very compelling reasons for the way she’s feeling. A lot of people are being impacted in a similar way:
- Every day we hear how bad the economy is. Even if you’re not getting downsized, or losing a mortgage, or trying to recover some of your lost investments, you’re exposed to the news everyday and everywhere. Like a healthy person eating junk food, it all starts building up internally. You can lose perspective, becoming more emotional and stressed out.
- There seems to be little precedent for this gloomy, worldwide situation. Usually, when times are tough, we can look to leaders, experts, or older or wiser individuals for guidance based on experience. It’s comforting during a crisis to hear someone say that they’ve seen this before, and they know what to do to fix this thing. But this time seems different. Further, it seems worse than before. And everyone seems to be just guessing. Looking for guidance, we often hear conflicting feedback. Consequently, on a subconscious level, our minds keep engaged on the subject. We can’t get that nourishing sleep or enjoy the good times quite like we did before.
- People’s fight or flight response may kick in but not have any outlet. So your body gets charged up, ready to take action. But instead, you’re spending time in the office, the car, or at home, and you’re not doing anything physical. Your body and your psyche then react in a bad way because our systemic responses were designed to deal with problems physically. Likewise, very few people regularly do things to calm down those hormones and enzymes through mental practices.
Each of these reasons is insidious. Any one of them can create enough stress to cause someone who is physically and emotionally healthy to start exhibiting unhealthy symptoms. When combined, these three reasons could be a recipe for a disaster if they aren’t dealt with effectively. Stress causes individuals to perform more poorly in all three key life aspects: career, personal, and financial. Most of us know that to be the case, but we don’t do much about it.
Here are six suggestions I’ve been sharing with our clients at BusinessSuccessCoach.net:
1. Take a deep breath. You’ve heard this many times, but here’s the thing – you probably don’t do it regularly. And it works. Doctors, sports coaches, and therapists will tell you that a deep breath, done thoughtfully, can do an amazing amount of good. It can clear your head, stop headaches, reduce your blood pressure, and make you less angry. That said, most people don’t do it regularly and even less so during difficult situations. If you don’t, you’re wasting a great opportunity to mellow out at any time and any place.
2. Remember that, without an outlet, you will carry your stress in your body. It won’t simply go away because the immediate aggravation is over for the time being. It manifests in things like back problems or stiff necks. It gets worse the longer you don’t give your body the chance to get rid of it by doing something physical. So do something. It doesn’t have to be demanding, just rejuvenating. For example, yoga is a great exercise for anyone at any level. Dancing(!) is great even by yourself. Anything to deal with the stress in a physical way.
3. Good sleep is critical. Without it, be prepared to face the consequences of becoming more emotional and less reasonable and less productive and more foggy, which is not great for your job performance. You’ll also see signs of aging more quickly and have more aches and pains. Everyone has a reason why they can’t sleep, such as the environment (their bed, their partner). Or they’ll say they can’t sleep due to their stress. The quality of the sleep is the issue — not how much time you spend in the bed.
4. Consider your diet. How much we eat and what we eat. Both can impact one’s ability to perform at peak efficiency. We all know that when someone is overweight, it can create health problems, cause stress, and affect sleep habits. Additionally, a person’s confidence may go downhill if they start having negative mental conversations with themselves about what they’re doing or not doing to themselves. Underweight people can be equally as self-negative, of course.
5. Quiet the mind. We actually can just stop thinking about all the bad stuff around us. And when we do, we feel positive and more relaxed, and we do more things to amplify those good feelings. Success breeds success, and usually when we’re on a roll, we do more of what we’re doing to improve our situation further. Stop tracking the news as much. I’m not suggesting that we put our heads in the sand, only that we understand that the news isn’t going to change a lot from day to day. You don’t need to be a news junky, reading every piece of bad news that is generated. What you feed your mind becomes who you are.
6. Help someone. It feels really good to help others. It creates a rush that is difficult to create in any other way. There are people in worse situations than you are, and you can volunteer your service. It doesn’t have to be a poor family down the road (although that’s a wonderful place to start) — it can be that guy across the cube who is struggling with something that you think is simple, or perhaps your aunt who never gets invited out for dinner because she’s a bit odd. This action helps improve your self-confidence and often improves your game at work.
A bonus tip: Express gratitude. There’s usually a couple of things that are good in everyone’s life. It’s valuable to focus on them. Regularly. Research on the subject indicates that being grateful for what we have is one of the primary causes of happiness and — here’s the big one — greater success. That’s right — those who are the most grateful for what they have in their lives enjoy more of those successes. Career, personal, and financial successes.
Inspired by our colleagues at Silicon.com, TechRepublic is launching a new CIO Jury and we’re looking for experienced IT leaders to respond to a simple straw poll twice a month when the subject is in your area of expertise. See if you meet the criteria.
——————————————————————————————————————————————————
CIOs control hundreds of millions of dollars of IT budgets, decide how to best utilize IT workers, and make critical decisions about which new projects and technologies to deploy. As a result, TechRepublic and the millions of IT professional who come here every month to find the latest trends and best practices in IT are keenly interested in what’s going on between the ears of these IT leaders.
Of course, because CIOs have so much responsibility they are also difficult to pin down and they have precious little time to participate in activities beyond the day job. So TechRepublic is going to be launching a new program that engages them every two weeks - with minimal effort on their part - in an informal straw poll on some of the most important and timely issues facing the IT world.
The TechRepublic editorial staff will develop the bi-weekly questions to send to the CIOs. We will also take suggestions from the TechRepublic community. To submit a potential CIO Jury question, you can simply click the Contact link at the top of this page.
The featured question will be e-mailed to the group of participating IT leaders along with a link to a related story that sheds light on the topic. The CIOs will then simply respond to the e-mail with a “Yes” or a “No” vote (or even a “Y” or “N” from a smartphone). For those inclined to do so, CIOs can also include a one or two sentence comment along with the vote.
To get a look at how this works, here are three examples of CIO Jury reports from Silicon.com:
TechRepublic has a core group of IT leaders that will serve as a foundation for the CIO Jury, but we’re also looking to expand that circle as we launch this program. Here are the basic qualifications that we’re looking for:
Here are the factors that disqualify IT leaders from participating:
“Wikipedia, citing the OED, says that the term robotics was first printed in Asimov’s short story ‘Liar!’ in 1941, not in ‘Runaround’ which was published in 1942.”
Asimov’s short story, “Runaround,” published in 1942 was indisputably the first printed use of the term “The Three Laws of Robotics” as Asimov formulated them. “Liar!” was published in 1941 and was the first appearance of the term robotics, irrespective of any explicit triumvirate of laws. I goofed that up in the original article. Thanks for the catch, and keep those quibbles coming.
Check out the Geek Trivia Archive, and catch up on the most recent editions of Geek Trivia.
What novel did Isaac Asimov write as a playful “correction” to another famous sci-fi writer’s scientific mistake?
The book in question is The Gods Themselves, which Asimov wrote (in part, at least) as a playful response to an exchange with fellow science fiction icon Robert Silverberg.
Asimov was in the audience of a panel at a sci-fi convention during which Silverberg was expounding upon the importance of emotional resonance and characterization over technical accuracy or high-concept ideas. Specifically, Silverberg noted (as Asimov recalled it) thus: “If you have your motivations straight…who cares about — uh — plutonium-186.”
This amused Asimov greatly, as the isotope plutonium-186 can’t exist — it’s inherently unstable and simply couldn’t form in our universe. He noted this to Silverberg, who simply shrugged it off, probably as underscoring his original point. Asimov, meanwhile, was fascinated with the idea of a world where plutonium-186 could exist, and he devised a plot around that idea. Specifically, The Gods Themselves involves a race of extra-dimensional aliens that swap out plutonium-186 in their universe for tungsten-186 in our universe, as each is a “free” energy source in the other dimension.
Asimov was famous for rarely including aliens or sexual encounters in his fiction, though both play prominent roles in The Gods Themselves. As such, an urban legend has developed that Silverberg dared Asimov to write a novel that included aliens and sex instead of some bizarre scientific macguffin like plutonium-186, and the result was The Gods Themselves. The truth is somewhat more prosaic, but nonetheless amusing.
(Incidentally, Asimov credited the inspiration for arguably his most famous short story, “Nightfall,” on a challenge from editor John W. Campbell. Perhaps that and the Silverberg story have been conflated in the sci-fi public consciousness.)
Meanwhile, Asimov’s two most infamous fictional substances — plutonium-186 and thiotimoline — eventually intersected. Robert Silverberg wrote a short story for the Foundation’s Friends anthology, “The Asenion Solution,” which depicted the use of thiotimoline to send plutonium-186 backwards in time to cause the Big Bang. That’s not just some amusing authorial interaction; it’s an intentional implausible intersection of Geek Trivia.
Screenshots of Windows 7 build 7077 have started to appear around the Web, with reports that the 32-bit version has been fully leaked and is downloadable from several websites.
Ars Technica reports that there are no noticeable differences between build 7068 and any of the 707x builds.
[Image Gallery: Windows 7 build 7077]
Interestingly, there isn’t a specified build string in the “About Windows” dialog box as has been seen in previous builds, saying only “Version 6.1 (Build 7077).” The public beta build was the only other version carrying the same format: “Version 6.1 (Build 7000).”
Ars reports that the build string for the latest build is “7077.0.090404-1255,” indicating that it was compiled less than a week ago, on April 4, 2009, at 12:55 p.m. This is 20 minutes after what has been called build 7105 was compiled, “widely rumored to be a milestone build,” Ars writes, given that Microsoft only increments the second digit of the build number if an important point in development has been reached.
As has been reported by our own Mary Jo Foley, Microsoft is expected to give a new build to testers this month, and a public Release Candidate build is coming in May.
Google announced an updated version
of Gmail for iPhone and Android-powered phones on Tuesday in the official Gmail blog. The new version is not a standalone app; it simply runs in your Web browser — and quite speedily, might I add. That being said, Google has introduced many new features that will surely make any Gmail user happy.
If you’ve ever been checking your e-mail on your phone, and have lost service, it might be frustrating to be unable to view the message you were just reading, or the directions to a party you had saved in your e-mail. The new Gmail for mobile allows you to open recently read messages and write e-mail even with no connection.
“You’ll notice that it’s a lot faster when performing actions like opening an e-mail, navigating, or searching. And if the data network drops out on you…, you’ll still be able to open recently read messages and to compose over a flaky, or non-existent, network connection,” said Google mobile engineer Joanne McKinley in a blog post.
One of the largest improvements is a new floating toolbar, or “floaty bar.” Gone are the days when you had to select a message, and then scroll all the way up to archive it. When you select a message, a floaty bar shows up near the top of the screen and gives you options to delete, or archive the message. You also can choose “more,” which lets you mark the message as read or unread, add or remove a star, or report spam.
The way you see the actual message, AKA the appearance, has also been revamped. Labels are now easier to read and look more like the labels you see in your computer’s Gmail.
Gmail for mobile only supports iPhone and iPod touch OS 2.2.1 or above. All Android-powered phones are supported. New features and improvements will continue to be added. Go to gmail.com from your mobile browser to try the new version.
The ongoing survey of VCs in the Bay Area found that venture capitalist confidence registered a 3.03 on a 5 point scale (5 shows high confidence). The first quarter read was up from the fourth quarter’s tally of 2.77, which was a five year low (see report overview, PDF).
Is it party time? Not quite.
University of San Francisco professor Mark Cannice writes:
This mustard seed of hope appears to be taking sprout among a majority of the venture capitalist respondents who provided their insight to the March 2009 survey. And it is nurtured by venture capitalists’ faith in the resilience of entrepreneurs to build efficient enterprises with disruptive solutions, more modest expectations for growth and valuations, and the early stages of a stabilization in the financial system. Most importantly, this hope is leading to a more optimistic climate and new investments, with numerous VCs believing that great companies tend to be launched in difficult economic environments. As venture capitalists take a long term perspective in shepherding their portfolio firms over years rather than quarters, investments made today are expected to grow and blossom on the other side of the current economic malaise. The modest but measurable uptick in confidence in Q1 breaks the extended decline and provides an important step toward new entrepreneurial growth opportunities.
Judging from the VC comments collected by Cannice it appears that:
VCs think the global economic crisis has stabilized;
But the economy is still an overhang;
Great companies will emerge in the economic wreckage;
And investments are like roach motels: There are no exit strategies.
Intel updates Atom lineup; Eyes second half Nehalem push
Intel on Wednesday announced two new Atom processors for Mobile Internet Devices (MIDs) and rolled out new designs for the Chinese market.
The chip giant made the announcement in Beijing to coincide with its Atom chip’s 1-year anniversary. Atom is the platform that powers netbooks.
Among the items detailed by Intel (statement):
Intel’s two new Atom processors are the Z550 and Z515. These chips can now reach 2GHz in using less than 3 watts of power.
Anand Chandrasekher, Intel’s general manager of the Ultra Mobility Group, showed off new designs for the Chinese market.
Laptops based on Intel’s Nehalem processor will be available “in the second half of this year.”
Intel’s multi-socket Nehalem EX server processor will be in production in the second half too. Nehalem EX will offer eight cores for the so-called “intelligent server” market.
Poll: IT pros love Windows 7; majority dump Vista
upgrade plans
Beta testers of Microsoft’s Windows 7 operating system are four times as likely to be happy with the new OS
than early users of Windows Vista, according to a recent poll of corporate IT pros.
In a poll of corporate IT professionals conducted by ChangeWave Research,
44 percent of the 68 users testing Windows 7 said that they were “very satisfied” with the beta. A similar survey by ChangeWave in February 2007, just weeks after Vista’s launch, found just 10 percent of the respondents expressing the same sentiment.
Researchers said that those who are happy with Windows 7 cited the new operating system’s improved performance as a big reason for their reaction.
“Takes less memory and boots faster, and reminds me of a new XP,” one IT professional told the researchers.
In the same survey, approximately 2,000 enterprise users responsible for IT purchases were polled to find out their companies’ current Windows plans. According to the poll, 53 percent of respondents said that their businesses are going to skip Vista altogether and instead wait for the arrival of Windows 7.
Only 15 percent said that their organizations would still proceed with a Vista rollout, and about 14 percent said that their companies were already deferring some PC and server purchases in anticipation of Windows 7
Researchers had the following to say:
Of course, beta testers tend to be hard-core techies and the ultimate test is how satisfaction holds up when mainstream users get their hands on the new software.
Importantly, Microsoft should remember Windows 7 isn’t the only game in town.
Are you holding off for Windows 7? [via]
Confusion and controversy continue at Satyam
Satyam, the Indian outsourcing company at the center of a massive fraud investigation continues to be mired in confusion and controversy.
Earlier in the week, the company’s former CFO appeared to give two PricewaterhouseCoopers audit partners a pass, saying:
…that auditors S Gopalakrishnan and Talluri Srinivas of audit firm Price Waterhouse had no role to play in the fraud, as they were given forged documents by the company management.
At the time I thought it unusual as a fraud case is often characterized as one of rats deserting sinking ships, with people taking everyone down with them. Then the story took a fresh twist when the New York Times asserted that the CBI, the Indian equivalent of the FBI had concluded its investigation and is charging nine people with fraud related offences including the PwC auditors:
After a 45-day investigation, the bureau said it was charging six people from Satyam Computer Services, two suspended auditors from PricewaterhouseCoopers and an outside adviser with “criminal conspiracy, cheating, cheating by personification, forgery of valuable security, forgery for the purpose of cheating, using a forged document as genuine, falsification of accounts and for causing disappearance of evidence.”
Not surprisingly, PwC was said to be ‘disappointed.’ I am confused. It seems that despite the exhortations of the former CFO, the CBI doesn’t believe him and consider PwC to be complicit in the affair.
Our sister title in Asia now reports that:
…the investigations have concluded, it is a matter of days before Satyam is likely to be sold. The company already has a list of suitors including Wilbur L. Ross Jr., the New York-based investor and rehabilitator of distressed assets globally, construction and engineering conglomerate Larsen & Toubro, Tech Mahindra, and private equity firm Apax Partners.
But bidders have complained about a lack of transparency and the need for access to Satyam’s books. Like everything concerning Satyam, even the sale is mired in controversy.
[My emphasis added]
In my last Satyam post, I considered the disposal as one characterized by indecent haste with political overtones. Commenters thought I was nuts and/or over reaching. They won’t be the first, or the last to hold that opinion. It now seems that my concerns about the ability to undertake proper due diligence were justified.
Regardless of the sale which some of my sources now believe will take the form of an auction, the Satyam story is far from over. It has been a blow to the Indian outsourcing industry at a time when the global economy is in poor shape and where confidence is everything. The real tragedy is for the many fine people who work or worked at the company.
New DroboPro NAS has 8 drive bays for 16TB storage
The professional business version of the popular Drobo NAS has arrived.
Yahoo! Messenger meets the iPhone, finally
With AOL Instant Messenger and Skype already available on the iPhone, it was only a matter of time before Yahoo! Messenger strolled into the game. Announced today on the Yahoo! Messenger blog, the messaging service allows you to instant message your friends, while offering a plethora of features.
The app has all the usual instant-messenger-suspects: emoticons, web links, and photo sharing. There’s really nothing too different about Yahoo! Messenger, but if you’re accustomed to using it on your computer, you’ll be happy to know you can take it on the go now.
It offers a stealth setting, which lets you sign in as invisible, or change your status once you’re signed on. A nice feature is the recent conversation archive, which shows your most recent conversation with each of your contacts, and lets you continue from where you left off in that conversation.
The app is free, and can be downloaded at the iTunes App Store, or through your iPhone by searching for Yahoo! Messenger. If you’re a Yahoo! Messenger fan, but you don’t own an iPhone or iPod touch, don’t worry, it’s also available for Blackberry and other mobile phones.
Microsoft on Wednesday will unveil its sixth Security Intelligence Report and the tome—all 184 pages of it—has a lot of interesting data points culled from the software giant’s antivirus applications. Microsoft concludes that rogue security software is a big threat, lost and stolen equipment is a bigger issue than hacking and PDF and Office extensions are leading vectors.
But we knew a lot of that already. We also know that Adobe’s monoculture and the patch cycle is less than perfect.
Here’s a look at my top five takeaways from the full Security Intelligence Report.
1. Vulnerabilities (and the reaction to them) vary based on whether the target is at work or home. Based on data provided by its enterprise Forefront Client Security and consumer Windows Live OneCare, Microsoft found that vulnerabilities are very different. Why? A corporate user may have email and Internet limitations that reduce the attack surface. A home user has more software tools to be infected.
Simply put, a home user is likely to get hit with a trojan attack. In the enterprise, the weapon of choice is that worm attack
The biggest difference between enterprise and home vulnerabilities is social engineering. Microsoft explains:
The Windows Live OneCare list also includes several families associated with rogue security software, such as Win32/Renos, Win32/FakeXPA, and Win32/Antivirus2008. The social engineering messages used in connection with rogue security software may be less effective in an enterprise environment, where malware protection is typically the responsibility of the IT department…By contrast, the Forefront Client Security list is dominated by worms, like Win32/Autorun, Win32/Hamweq, and Win32/Taterf. Worms rely less on social engineering to spread than categories like trojans and downloaders do, does and more on access to unsecured file shares and removable storage volumes, both of which are often plentiful in enterprise environments.
2. Users don’t always remove unwanted software: There’s appeal in the “ignore” button. Microsoft explains one nuance of the malware issue:
Software cannot always be classified in binary terms as “good” or “bad.” Some software inhabits a gray area wherein the combination of behaviors and value propositions presented by the software is neither universally desired nor universally reviled. This gray area includes a number of programs that do things like display advertisements to the user that may appear outside the context of the Web browser or other application and which may be difficult or impossible to control.
Microsoft’s scans allow users to ignore a security alert, allow software to remain, issue a prompt, quarantine or remove it.
If software is really malicious it is removed without user input. The gray areas appear when users have a choice. Microsoft adds:
These decisions are influenced by a number of factors, such as the user’s level of expertise, how certain they feel about their judgment regarding the software in question, the context in which the software was obtained, societal considerations, and the benefit (if any) being delivered by the software or by other software that is bundled with it. Users make choices about what to do about a piece of potentially unwanted software for different reasons, so it’s important not to draw unwarranted conclusions about their intent.
Threats dubbed moderate or low are often ignored by users, who think that there’s value in the software. These threats are keepers based on user behavior:
3. Rogue security software gains momentum. The concept of rogue security software is pure genius. Malicious hackers prey on fears of users, cook up bogus security software and extract payments to keep your PC running. Microsoft notes that rogue security software is becoming a hot category. Microsoft reports:
Rogue security software authors have long attempted to exploit this trust by giving their programs generic, anodyne names, like “Antivirus 2009,” and making them resemble genuine security software in many ways. Recently, many threats have taken this approach a step further, posing as components of the operating system itself or as a familiar search engine. One of the first families observed to exhibit this behavior was Win32/FakeSecSen, which was added to the MSRT in November 2008 and was the eighth most prevalent family in 2H08 overall. Win32/FakeSecSen adds an icon to the Control Panel named Vista AV or MS AV and fraudulently uses the same four-color shield icon as the Windows Security Center. Double-clicking the icon launches the rogue software, which claims to detect a large number of nonexistent threats and urges the user to “activate” the software by paying for it.
Win32/Renos is a longtime threat that delivers rogue security software was the most prevalent threat in the second half of 2008. Two new trojans–Win32/FakeXPA and Win32/FakeSecSen was the seventh and eight most prevalent family class.
4. Social networking phishing attacks represented less than 1 percent of attacks, but yielded a big chunk of phishing impressions. Translation: Social networking sites will remain a big phishing target.
Microsoft explains:
A typical social network phish is likely to trick an order of magnitude more users than a typical financial phish. There are a number of explanations for this discrepancy. While financial institutions targeted by phishers can number in the hundreds, just a handful of popular sites account for the bulk of the social network usage on the Internet, so phishers can effectively target many more people per site. In addition, phishers often use the messaging features of the sites themselves to distribute their attacks, typically by gaining control of a user’s account and using it to send phishing messages to the victim’s friends. These attacks can be much more effective than e-mail–based attacks, because they exploit the considerable level of trust users place in their friends.
5. Malware is dominant in the U.S. and accounted for 67 percent of all infected computers. Trojans—the miscellaneous variety–were detected on 29.4 percent of infected computers. Among other items:
Five of the top 20 families detected in the United States in 2H08 (Win32/Renos, Win32/FakeXPA, Win32/FakeSecSen, Win32/Antivirus2008, and Win32/Winfixer) download rogue security software or display misleading warning messages to convince users to purchase a program that supposedly removes spyware.
Here are the top five individual threats:
Conficker worm's copycat Neeris spreading over IM
The U.S. electrical grid: How big of a cyber target is it?
Paul McCartney's official site serving malware
A single Windows platform for phones and PCs: Can it be done?
Is there an open source alternative to Microsoft Outlook?
Trojan downloaders and droppers were detected on 24.4 percent of all infected computers.
Conficker worm's copycat Neeris spreading over IM
Imitation has always been a form of flattery, and that’s particularly true for the cybercrime ecosystem. From the lone Chinese cybercriminals releasing DIY tools for generating malware actively exploiting the MS08-067 flaw, followed by the original Conficker worm, Microsoft’s MMPC (Malware Protection Center) is reporting on a currently spreading Conficker copycat detected as Worm:Win32/Neeris.gen!C.
The latest variant of Neeris which has been in the wild since 2005, is mimicking all of Conficker’s spreading techniques, including the exploitation of MS08-067 and the AutoRun spreading tactic, but is continuing to propagate through its original method - sending links over MSN. With the Neeris copycat now in the game, what are the chances that it would steal some of Conficker’s market share? Pretty pessimistic.
The Neeris author also attempted to launch the campaign beneath the radar with Microsoft’s MMPC pointing out that the peak of the campaign took place on late March 31st and during April 1st, Conficker’s largely overhyped update activation date. However, this tactic is not going to compensate for some of the obvious mistakes that the author made in the form of using bogus time stamps for the malware, and the use of easily spotted as malicious attachments (.exe;.scr) even by the average Internet user.
Copycats don’t just share the same propagation/infection vectors, they also share the same mitigation ones.
Twitter: Under attack
We all knew it was going to happen sooner or later. So it’s no surprise that Twitter is under attack. The important thing now is knowing what to do about it.
Twitter came of age during the weekend of 11 April 2009. Like any new IT technology, it was just was a matter of time before someone decided to look under the hood and see how the application could be debased. The compromise is a story with a different twist though, kind of like Twitter itself.
StalkDaily/Mikeyy worm
Mike Mooney, a 17 year old teenager started the ball rolling. After finding a Cross-Site Scripting (XSS) vulnerability in the Twitter application, he altered the code on four Twitter accounts to leverage the new found vulnerability.
Once set up, it was just a matter of waiting, kind of like fishing. Finally someone viewed the profile Web page belonging to one of his Twitter accounts and through the magic of a drive-by dropper proudly became the first victim. Finding more victims got lot easier after that as the worm started propagating using the following steps:
Each newly-infected Twitter application starts sending unauthorized Twitter messages (tweets) with malicious links to all available contacts found in the compromised Twitter account.
The flagged Twitter users start receiving tweets from a supposedly trusted contact (social engineering part).
The tweet asks them to check out a micro-blogging service called StalkDaily.com (hence the worm’s name).
As soon as the link is clicked, the Twitter application on that computer becomes infected with the worm.
It’s easy to see how the number of victims grows rapidly. Especially if some of the initially infected Twitter accounts have large contact lists.
To make matters worse, users who haven’t received a malicious tweet can also become infected just by looking at a compromised Twitter profile page. For those so inclined, Damon Cortesi has posted a blog that takes an in-depth look at how the worm works.
Several strains
The explanation I gave above is the generic overview as there are at least four versions that have surfaced, each exhibiting slightly different social engineering techniques. To Twitter’s credit, they have been able to remove the problem each time, but the underlying Twitter application still appears to be vulnerable to XSS attacks.
How to remove
Even though the developers at Twitter have somewhat rectified the problem, there are still the infected profiles. So, I’ve looked around and found removal instructions for both the StalkDaily and Mikeyy variants of the worm on the Twittercism Web site:
In your browser, clear your cache and empty all of your cookies. (This can be found in your settings.)
Log out of TweetDeck or any external applications you are using.
Check the URL and location areas of your profile (in Settings/Account on Twitter.com) for evidence of any malicious scripts. It’ll be obvious - something you haven’t added to these areas yourself. If you find anything, remove it.
On Twitter.com, change your password.
Log back in.
Go back and delete any tweets sent by you recommending StalkDaily. This is important.
Report @stalkdaily in a tweet to Twitter’s @spam account as follows: @spam @stalkdaily.
How to prevent this
Twittercism also has an excellent blog post that talks about how to prevent worms like StalkDaily and Mikeyy from infecting your Twitter profile. I’d thought I’d share a few of the more important points:
Use A Twitter Client. It appears that the infection takes place while visiting the profile page, which is easy to do when using the Twitter Web interface. To avoid accidentally opening profiles use a Twitter client like TweetDeck.
Avoid Visiting User Profiles On Twitter.com. This refers to active links that are advertised in Tweets or e-mail alerts about new followers.
Be Wary About Clicking On Shortened URLs. I’ve referred to this before in my article “URL Shortening: Yet another security risk” and it’s becoming even more of a problem.
Another big help in fighting this worm as well as other malware is to turn JavaScript off. That may not be possible for many though. If not, I’d recommend using FireFox with the NoScript add on.
Next step
Since XSS vulnerabilities are a big part of this problem, I wanted to point out a recent article by Brian Krebs of the Washington Post, “Creating a Public Nuisance with Insecure Web Sites,” where he discusses issues surrounding XSS and hints at what the nasty types are trying to capitalize on:
“XSS bugs can even be used to power Web-based worms. This past week, a series of worms took advantage of XSS flaws on micro-blogging site Twitter.com to annoy and frighten thousands of Twitterers. While the worms were otherwise harmless, rogue anti-virus vendors have begun seizing on public interest in the outbreaks by gaming search engine results to send curious searchers to booby-trapped sites that try to foist worthless and invasive software.”
Google search promotes malware
TrendLabs verified what Brian was trying to point out in one of their e-mail alerts. The message is simply this:
“Cyber criminals are taking advantage of the public’s interest and high media coverage of the incident to spread malicious links. Among the top ten search results in Google for “Twitter worm” and “Mikeyy,” the name of 17-year-old author of the said worm, is a link that connects the user to a malicious URL that download malware into his/her system. The link in the result connects to a URL detected as HTML_DLOADR.NIC. The said URL is inaccessible as of this writing, but analysis reveals that it loads a JavaScript which is detected as JS_DLOADR.NIB“
Final thoughts
It seems that the Twitter worms themselves were relatively benign. What’s obviously not benign is using Web sites touting the cure to hide real malware. Sadly it’s an effective propagation method that takes advantage of users who are already having computer problems. My article, “Minimize risk when downloading from the Internet” triggered a lot of discussion about this subject, with members presenting many good ideas for avoiding this type of scam.
TechRepublic’s IT Security e-mail newsletter (delivered every Tuesday) is a great way to keep on top of security issues related to Information Technology. Please make sure to sign up.
Hacker vs. cracker
The word “hacker” gets used in a pejorative sense by journalists an awful lot. Some people think this is perfectly reasonable; others find it offensive, and recommend an alternative term for that meaning. Read on to find out why.
In mainstream press, the word “hacker” is often used to refer to a malicious security cracker. There is a classic definition of the term “hacker”, arising from its first documented uses related to information technologies at MIT, that is at odds with the way the term is usually used by journalists. The inheritors of the technical tradition of the word “hacker” as it was used at MIT sometimes take offense at the sloppy use of the term by journalists and others who are influenced by journalistic inaccuracy.
Some claim that the term has been unrecoverably corrupted, and acquired a new meaning that we should simply accept. This descriptivist approach is predicated upon the assumption that there’s no reasonable way to communicate effectively with the less technically minded without acquiescing to the nontechnical misuse of the term “hacker”. I believe it’s still useful to differentiate between hackers and security crackers, though, and that terms like “malicious security cracker” are sufficiently evocative and clear that their use actually helps make communication more effective than the common journalistic misuse of “hacker”.
I think it’s useful to differentiate especially because there are many situations where “hack”, and its conjugations, is the only effective term to describe something that has nothing to do with malicious violation of security measures or privacy. When you simply accept that “hacker” means “malicious security cracker”, you give up the ability to use the term to refer to anything else without potential confusion.
Both are distinct from people whose interest in technical matters is purely professional, with no desire to learn anything about the subject at hand other than to advance a career and make a living. Many hackers and security crackers turn their talents toward professional ends, of course, and some security crackers got where they are only through professional advancement, but one definitely need not have a professional interest to pursue the path of either a hacker or a security cracker.
A hacker, in the classic sense of the term, is someone with a strong interest in how things work, who likes to tinker and create and modify things for the enjoyment of doing so. For some, it is a compulsion, while for others it is a means to an end that may lead them to greater understanding of something else entirely. The RFC 1392: Internet Users’ Glossary defines “hacker” as:
A person who delights in having an intimate understanding of the
internal workings of a system, computers and computer networks in
particular. The term is often misused in a pejorative context,
where “cracker” would be the correct term. See also: cracker.
The Jargon Wiki’s first definition for hacker says:
A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary.
A security cracker, meanwhile, is someone whose purpose is to circumvent or break security measures. Some security crackers end up using their powers for good, providing penetration testing services or otherwise making efforts on the side of the angels. Many others use their powers for evil, however, as we are all too painfully aware. Both RFC 1392 and the Jargon Wiki provide definitions of “cracker” that support this use of the term.
Maintaining distinct terms for distinct phenomena is an important aspect of communication, as demonstrated in the incident I described in Managers and technologists live in different worlds, where a company executive and I used the same term to refer to two different things and failed to communicate effectively as a result. When two different phenomena acquire the same label, as in the case of hackers in the classic sense on one hand and malicious security crackers on the other, either something has to give or discussion is bound to suffer from confusion that could easily have been avoided.
The more easily relabeled of the two uses of the term “hacker” is the malicious security cracker: it is not only the more recent phenomenon to acquire that label, but also the one whose meaning is most easily evoked by an alternative term. This is why, when you read an article of mine that talks about malicious security crackers, I use the term “malicious security cracker” — and in an article that talks about hackers in the classic sense of the term, I try to differentiate clearly between these two uses of the term “hacker” before using it myself.
For purposes of clarity when communicating with others about security issues, I recommend you do the same.
How secure is your bank card?
Personal Identification Numbers, or PINs, are supposed to provide secure authentication for bank cards. Unfortunately, they are increasingly failing to do so.
Most of you have probably heard about ATMs with skimmers mounted over the card slot that can read your card on the way in and out of the machine, with carefully placed cameras to read your PIN as you type it in. The person setting up this little trap can then clone the card with the skimmed data, and with the pin gets access to your bank accounts. The first time I remember hearing about that method for cracking PIN security on bank cards was in the early ’90s, so it’s not exactly a new technique.
More recent developments in bank card security cracking include malicious phishing Websites, cross-site scripting, and legitimate Websites that have been directly compromised by security crackers. It’s an especially disturbing phenomenon because bank cards don’t usually have the same zero liability protections as credit cards — a fact most users of debit cards don’t think about when they use their bank cards the same way they’d use credit cards.
A new, and even more disturbing, security vulnerability for bank cards has arisen.
A research fellow at the French National Institute for Research in Computer Science and Control (say that five times fast) named Graham Steel wrote a paper in 2006 that addressed vulnerabilities in the hardware security modules that tie the bank card authentication network together. The paper, submitted to British HSM manufacturer nCipher, provided guidelines for hardware security module configuration that would help mitigate the vulnerability of the devices to attack, but it also pointed out that other aspects of HSM vulnerability were inherent to their design. To really and truly fix the problem of HSM vulnerability, the devices would have to be fundamentally redesigned in a manner that is not backward compatible. Payment processing networks across the globe would have to be reimplemented using a different, improved standard.
HSM manufacturers such as Thales-eSecurity maintain that they address the security vulnerabilities addressed by Steel’s paper, but thus far they seem to be taking an approach remarkably similar to the way Microsoft OSes are “secured” against viruses. Other reassurances that HSM manufacturers are seeing to our security involve statements about how the devices are delivered in a very secure configuration by default, which is all well and good if you don’t need them to actually do much. Unfortunately, most payment processing transactions require functionality to be enabled that exposes the devices to significant potential for compromise. As Brian Phelps of Thales-eSecurity put it, according to the Wired article PIN Crackers Nab Holy Grail of Bank Card Security:
It’s a very difficult challenge to protect against the lazy administrator. Out of the box, the HSMs come configured in a very secure fashion if customers just deploy them as is. But for many operational reasons, customers choose to alter those default security configurations — supporting legacy applications may be one example — which creates vulnerabilities.
He went on to confirm Steel’s estimation of the scope of the problem, saying that redesigning the payment processing system to comprehensively address the current vulnerabilities due to legacy systems compatibility needs “would require a mammoth overhaul of virtually every point-of-sale system in the world.” If this doesn’t send a chill down your spine, either you aren’t paying attention, or you don’t actually use a bank card.
It is only recently that verifiable incidents of PINs being skimmed from HSMs, either gathered unencrypted from the device’s volatile memory or picked up as encrypted PIN blocks and decrypted. In some cases, at least, the decryption is made possible by the fact that the HSMs themselves contain decryption keys, and once one encrypted PIN block is decrypted it becomes much easier to decrypt the rest of them.
At first glance, one might think that the idea of storing decryption keys on devices scattered around the country that relay PINs from point to point using a model conceptually similar to Internet routing itself should have been immediately recognizable as a bad one, thanks to the example of the inherently flawed concept of digital DRM. Of course, the design of payment processing hardware security modules predates the AACS key for HD-DVDs, the Sony DRM rootkit, and Microsoft’s WGA. HSM designers get a free pass on learning from the mistakes of others, although the fact the mistake was made in the first place should have been avoidable.
For the most part, the problem is the way HSMs pass PINs around, tend to have scads of unnecessary features enabled at any given time, and contain the keys needed to decrypt the encrypted PINs. A couple of key points include:
End-To-End Encryption: The PINs should be encrypted and decrypted only at the end-points. Encrypting and decrypting anywhere between those points just increases the options for unauthorized interception.
Private Key Encryption: Using standardized encryption keys is tantamount to criminal negligence in this age of private key cryptography. Each and every end-point, including the bank cards themselves and the receiving systems that need to authenticate a request, should have a private and public key set. This way, you’d only be able to read data if you’re one of the unique end-points that is supposed to have access to it.
As things currently stand, however, the likelihood of the system being overhauled is pretty slim due to the immense cost that would be involved in replacing an entire global payment processing network with an incompatible standard. As a result, this problem is likely to be addressed only in a superficial, “it works right now and that’ll have to be good enough” manner. In many cases, it may not even be secured that well. Be extremely careful where you use your bank cards in the future. While liability protection for credit cards tends to be better than for debit cards, even there you should be wary of the potential threat.
I, for one, prefer to use cash anyway. Credit card and ATM transactions often impose fees on the user, and even when they don’t, it’s usually because one financial institution or another involved in a given transaction just “eats” the cost. Such behind the scenes payments contribute to price inflation, depressing the value of my money, which I tend to consider a bad thing.
With the revelation of incidents in the wild where the vulnerabilities discovered by Graham Steel (and others) are exploited to harvest PINs directly from payment processing networks around the world, I have one more reason to prefer cash transactions.
The PCI Security Standards Council has stated that it will begin a hardware security module testing program that focuses on “security properties that are critical to the payment system.” I hope the problem turns out to be more easily solved than the evidence thus far seems to suggest, but I’m not holding my breath. The problem appears to be endemic to the system itself, as it is currently designed and implemented.
Patch Tuesday: Several updates fix zero-day exploits
Microsoft’s April patch Tuesday is a serious one. Three patches fix zero-day exploits and four fix published exploits. Want to know which ones are which?
“Remember Conficker” should be Microsoft’s slogan of the month for April, rallying people to remember that millions of computers were infected with Conficker simply because one patch wasn’t installed. Why’s that significant? Microsoft’s April update schedule has fixes for seven “Conficker wannabes”?
“If you manage workstations this will be a busy month. Microsoft encourages us to act quickly with the bold note on many of the updates: “This vulnerability is currently being exploited in the Internet ecosystem.” This is the strongest language I’ve seen on any of the comments in the new Exploitability Index since Microsoft began using it last October. Not only is exploit code likely but it’s in the wild.”
Which ones are important?
TechRepublic’s Justin James kindly defined each of the critical patches in his post, “It’s Windows Patch Tuesday: April 2009” and described several additional patches that aren’t carrying MS’s critical rating.
Being an anal IT security person, I thought it best to point out which patches covered vulnerabilities that have zero-day (already in the wild) exploits. Those are MS09-009, MS09-010, and MS09-012. So if it’s not possible to install all of the updates right away, please focus on those three.
Next are the updates that fix vulnerabilities with released malcode, but aren’t active exploits as of this writing. Those are MS09-013, MS09-014, MS09-015, and MS09-016. Those should be next on the list to install.
Final thoughts
Hopefully, the number of critical patches didn’t catch anyone off guard, with everyone scheduling enough time to test, install, and reboot. Good luck.
TechRepublic’s IT Security e-mail newsletter (delivered every Tuesday) is a great way to keep on top of security issues related to Information Technology. Please make sure to sign up.
GhostNet: Why it's a big deal
The Tibetan Government in Exile asked the Information Warfare Monitor consortium to investigate allegations of cyberspying. It appears they’ve found evidence of spying plus a whole lot more and that should concern all of us.
To begin, Information Warfare Monitor (IWM) is a well-regarded research team consisting of the SecDev Group and the Citizen Lab, Munk Center for International Studies, University of Toronto. The following skill set will explain why the Tibetan government asked the IWM for help:
Operational Case Studies: Consisting of active operational research employing a cross-disciplinary fusion of intelligence gathered at the field level with advanced network monitoring/visualization techniques.
Analytical products: Generate case study data that illustrate the strategic significance of cyberspace and highlight the opportunities, challenges, and threats implicit to a militarization of cyberspace, including effects generated by third-party actors.
From the beginning
This compelling story about the Dalai Lama and the Tibetan Government in Exile started almost a year ago. That’s when office workers began to complain about misbehaving computers. To us IT types that may seem like business as usual, yet it was the first clue of something being drastically wrong.
After some initial troubleshooting by the Tibetan IT personnel, the IWM group was called into help. It didn’t take analysts from IWM long to determine that several computers were indeed victims of a Trojan program called Gh0st RAT. For those interested, it’s an offspring of the famous Poison Ivy trojan.
Infection via e-mail
The next step was to figure out how the computers were being compromised. IWM researchers eventually determined that opening an attached document (containing malware) was the catalyst for becoming infected. I couldn’t find any mention as to what dropper program was used. Moot point I guess, as the goal was to successfully get Gh0st RAT on the intended computer. The research paper did mention:
“Only 11 of the 34 anti-virus programs provided by Virus Total recognized the malware embedded in the document. Attackers often use executable packers to obfuscate their malicious code in order to avoid detection by anti-virus software.”
Even so, malicious attachments are a well-known attack vector and that method shouldn’t have worked, right? Maybe, except these attackers were very creative, using appropriate e-mail addresses and realistically-named attachments like “Translation of Freedom Movement ID Book for Tibetans in Exile.doc”. Honestly, the following example looks official to me:
Even sneakier
Misleading the office workers became easier for the attackers once several computers were infected, simply because the attackers then have authentic documentation and contact information:
“Once compromised, files located on infected computers may be mined for contact information, and used to spread malware through e-mail and document attachments that appear to come from legitimate sources, and contain legitimate documents and messages.”
Something I didn’t think about was the coincidental spreading of Gh0st RAT. Since the attachments looked real and Gh0st RAT typically doesn’t affect normal computer operations, workers may have inadvertently sent the malicious attachments to others, hastening the trojan’s propagation:
“It is therefore possible that the large percentage of high value targets identified in our analysis of the GhostNet are coincidental, spread by contact between individuals who previously communicated through e-mail.”
I’m not sure how you combat social-engineering; it’s been around a long time and appears here to stay.
Sadly enough, that wasn’t the Tibetan system administrator’s only problem. They had the exploitable operating system vulnerabilities (we all know and love) to deal with. The report didn’t offer any more detail, so I’m not sure whether the attackers used zero-day exploits or if the computers weren’t fully updated.
What’s Gh0st RAT capable of?
Ghost RAT (Poison Ivy) is considered a Remote Administration Tool (RAT), basically a remote access program like VNC. Allowing the attacker almost complete control over the victim computer. Poison Ivy/Gh0st RAT is capable of the following:
Files can be manipulated completely and the attacker can upload/download files to and from the system.
The registry can be viewed and edited.
Active services can be viewed, suspended, or shut off.
Enabled network connections can be determined and shut disabled.
Installed devices can be viewed and some devices can be disabled
Installed applications can be viewed and entries can be deleted or programs uninstalled.
Being recently updated, Gh0st RAT has a few additional features that make it an effective spy tool:
Screenshots of the desktop can be taken,
Web cams, microphones, and audio/visual recording programs can be enabled to act as surveillance devices.
Passwords and password hashes are saved.
Key loggers can be used in conjunction with other devices to steal information.
All and all, it appears to be an efficient remote admin tool. If you aren’t convinced, check out Symantec’s detailed video that explains Gh0st RAT’s capabilities.
Many Gh0st RATs equal GhostNet
I consider the discovery of the GhostNet to be exemplary detective and forensic work. Initially the IWM team didn’t know what to expect as they worked their way from individual computers infected with Gh0st RAT back to the GhostNet control servers:
“During this process we were able to find and access web-based administration interfaces on the control server identified from the OHHDL data. These servers contain links to other control servers as well as command servers, and so therefore we were able to enumerate additional command and control servers.”
Once they had penetrated the control servers they began to get an idea as to how many computers were members of the GhostNet:
“In total, we found 1,295 infected computers located in 103 countries. We found that we were able to confidently-on a scale of low, medium, high-identify 397 of the 1,295 infected computers (26.7%), and labeled each one as a high-value target. We did so because they were either significant to the relationship between China and Tibet, Taiwan or India, or were identified as computers at foreign embassies, diplomatic missions, government ministries, or international organizations.”
Further insight
I’d recommend listening to Jesse Brown’s (CBC.ca) podcast titled, “Exposing the world’s biggest cyberspy ring“, as he interviews members of the IWM team who were directly involved with the project. I’d also like to recommend the IWM’s official report, “Tracking GhostNet: Investigating a Cyber Espionage Network“; I consider it to be an exceptional document, offering proof as well as a definitive explanation of the entire investigative process. It’s the report that I’ve quoted numerous times in this article.
Final thoughts
It sounds like the Internet is slowly becoming a war zone. How prevalent is this type of electronic espionage? Who’s involved, or is it easier to say who isn’t involved? Depressing isn’t it. Odd as it sounds, I remain hopeful because of organizations like IWM. Their hard work is making the Internet a safer place.
TechRepublic’s IT Security e-mail newsletter (delivered every Tuesday) is a great way to keep on top of security issues related to Information Technology. Please make sure to sign up.
