Dr. Bill | The Computer Curmudgeon

Get ready to get your security updates! M$ has found five BIG security flaws in Windows and Office that will allow someone to take over your computer!

Microsoft Warns of 5 “Critical” Security Flaws

“Microsoft Corp. (MSFT.O: Quote, Profile, Research) on Tuesday warned of five ‘critical’ security flaws in its Windows operating system and Office software that could allow attackers to take control of a computer. Microsoft, whose Windows operating system runs on 90 percent of the world’s computers, issued patches to fix the problems as part of its monthly security bulletin. The world’s biggest software maker defines a flaw as ‘critical’ when the vulnerability could allow a damaging Internet worm to replicate without the user doing anything to the machine.”

Alright! The word is getting out! People are realizing that Internet Explorer is not safe! Firefox usage continues to grow! Life is good!

Firefox Use in the U.S. Passes 15%!

“Worldwide, Firefox now holds 12.93 percent of the market, up from 11.79 percent in May. The open source browser commands a 15.82 percent usage share in the United States, and a whopping 39.02 percent in Germany. Australians are also big Firefox users, with the browser holding 24.23 percent of the market down under. Internet Explorer use worldwide has fallen below 80 percent in the United States to 79.78 percent, according to OneStat, although IE still accounts for 83.05 percent of the browser market globally. British Web surfers are the biggest IE users, giving Microsoft’s browser 86.23 percent of the market.”

Every so often I have to explain e-mail relaying to a client so that they can figure out how to set up their e-mail if they are hosting a domain with me. I thought the general information might be interesting enough that others might benefit as well, so here’s the explanation I sent out:

—–

OK, here’s how it all works.

A user has an Internet Service Provider that provides the “wire” to their house. For clarity, we will call this company “ISP.com.” They are the ones that you pay for your DSL, or broadband, connection. In my case, for instance, I have a broadband connection provided by the Piedmont Triad Road Runner division of Time-Warner. So, ISP.com provides service to you. You are in their “cloud” of domain security, and they, by default, “trust” you as “one of their own.â€? It is a cozy, happy relationship. As far as ISP.com is concerned, your house, and your PC, are “on their network” and they allow you to “send and receive” pretty much whatever you want, to and from, them.

Now, outside of ISP.com, there are other ISP’s, other companies, and other network services. These folks are “outside” the friendly confines of ISP.com. ISP.com does NOT trust these other companies. And, sadly, they shouldn’t! There are too many bad guys out there to lower your guard! I have often said that the Internet is like the old “Wild West” days. You have to carry a six-shooter with you to protect yourself from the guys in black hats!

Now, you (a member of the ISP.com community) contracts with an outside vendor to provide business e-mail (like me,) we with call this company “MAIL.com.” MAIL.com has it’s own DNS, infrastructure, e-mail servers, firewalls, and, it, too, has a responsibility NOT to trust anyone outside of it’s “cloud” of influence. MAIL.com trusts YOU as a customer, but MAIL.com DOESN’T trust ISP.com, and ISP.com doesn’t trust MAIL.com. Rather than being a bad thing, in computer and networking circles, this is “business as usual” since both companies know that the rules are; “If I can’t control it in my own datacenter, then it is NOT to be trusted.â€?

Mail servers have an ability called “relaying” that allows one trusted source to “relay” mail to another trusted source. “Relaying” is ONLY turned on WITHIN a network “owned” by the vendor that controls it. For instance, MAIL.com may have four servers sending mail BEHIND their firewall, and WITHIN their own datacenter. Among this “big, happy family,” these servers may be set to relay mail to each other all day long. But, MAIL.com would NEVER open a relay to ISP.com, and ISP.com would NEVER open a relay to MAIL.com. On the Internet, these mail servers are called “Open Relays” and as soon as they are found, they are “blacklisted” as spamming servers, or, they are isolated in other ways to be sure that they do not become “carriers” of all the ills of the Internet like Viruses, Spam, Malware, etc. No one wants to be found out to be an “Open Relay” server. Aside from the fact that it is bad computer management, and opens up abuse problems, it is also just plain “dumb,” and other computer geeks think that the company that does this is clueless and should be sent back to Networking 101! (They also poke fun at them in dark, shady, corner Geek Bars and have a laugh at their expense!)

So, what is a customer to do? He (you, in this case) is “stuck” between two “Wild West gunslingersâ€? that don’t trust each other! However, MAIL.com trusts YOU as its customer, and ISP.com trusts YOU as its customer! So, you can RECIEVE mail from MAIL.com, and you can SEND mail from ISP.com! Therefore, you have to set up your mail client so that:

INCOMING mail is set to the e-mail server at MAIL.com
OUTGOING mail is set to the e-mail server at ISP.com

In this way, you can both send mail OUT, because ISP.com trusts you. You are in their network, after all. And you can receive mail sent IN to “insert-your-personal-domain-here”.com because MAIL.com trusts you as a customer and will gladly send your client e-mail destined to you.

So, now, let’s drop back to the “real world” at my house, as a real “for instance.” My ISP is Road Runner, so I would have my home e-mail set to SEND OUT via Road Runner. But I would have my RECIEVE server set to DrBillBailey.NET (since that is my personal domain.) So, my e-mail client would be set:

SMTP OUTGOING server: smtp-server.triad.rr.com
SMTP (or POP3) INCOMING server: mail.drbillbailey.net

Now, since I am “within” the Road Runner “world” I don’t even need a password to “relay” off the “local-to-me” Road Runner e-mail server. However, I DO need a username and password to connect to my personal account at DrBillBailey.NET.

So, what you will need to do, is be sure that your e-mail client is pointing toward YOUR ISP’s SMTP server for OUTGOING SMTP traffic, and to the e-mail server at “insert-your-personal-domain-here”.com’s server (with your username and password) for the INCOMING mail. This SHOULD clear up any problems. Sorry for the long story, but I have found it helps to “get” the underlying concepts when setting these things up!

Well, it is official… “google,” with a small “g,” is now a verb! The 11th edition of the Merriam-Webster Collegiate Dictionary lists “google” as a new word!

“Google” Goes From Web to Webster’s

“The definition: ‘to use the Google search engine to obtain information … on the World Wide Web.’ As in, ‘Let me google that.’ Linguists said google entered the lexicon especially quickly. It reached the pages of the dictionary just five years after its first known public reference as a verb in a New York Post article. Usually, it takes 10 to 20 years for words to enter everyday use, if they make it at all. Google’s speed ‘is typical for words used on or about the Web,’ said John Morse, president and publisher of Merriam-Webster Inc. ‘Those are words that establish themselves in the language the quickest because of the power of the Web to propagate words.'”

The Ipod from Apple has 70% of the personal digital media market locked up. Will a new offering from Microsoft make a dent in this market?

Microsoft Ipod-Killer?

Microsoft has the money and the “clout,” but will they pull it off? They plan on having an “iTunes-like” site to provide content for their new device as well.

“The new player, which Microsoft Corp. has been touting to record companies in the last few weeks, will let users download music and videos over the air, according to one source, a feature which would give it an edge over the iPod. Microsoft Corp. has also been showing a new media software, developing an application akin to Apple Computer Inc.’s iPod/iTunes integrated ecosystem, according to another source. Record companies are expected to be receiving prototypes to test in the coming weeks, said the first source. The sources said Microsoft will be throwing significant marketing dollars behind the launch.”

A “gentleman” has decided to release sample code at the rate of one-per-day for every major browser this month! Sigh. THIS we REALLY don’t need! I suppose he is trying to make a point… but you just KNOW that folks are going to impliment these exploits to make life even more painful than it already is on the net! There has to be a better way!

A Browser Flaw a Day Keeps Hackers at Play

“A well-known hacker has stockpiled browser exploits and plans to release one flaw a day for the month of July to highlight the types of vulnerabilities affecting the world’s most widely used Web browsers. HD Moore, co-founder of the Metasploit Framework, has launched a new project called MoBB (Month of Browser Bugs) with daily releases of proof-of-concept code for flaws in Internet Explorer, Firefox, Safari, Opera and Konqueror. ‘We will publish a new browser hack, every day, for the entire month of July. The hacks we publish are carefully chosen to demonstrate a concept without disclosing a direct path to remote code execution,’ Moore said in a blog entry announcing the project.”

Ack! A “Month of Browser Bugs,” indeed! In case you haven’t already read it, I would suggest my article on, “How be Be Safe on the Web!,” available at the link below:

Dr. Bill’s “How to Stay Safe on the Web”, or, “It is Good to be Paranoid!”

After swearing up-and-down that they weren’t gonna, they didn’t need’ta, and they were gonna take their ball and bat and go home… Microsoft has grudgingly agreed to support OpenDocument in their new (and delayed) Office product!

Microsoft Bows to Pressure to Interoperate with ODF

“Microsoft is giving in to the unrelenting pressure to be more open, particularly with regard to its Office Open XML file format and interoperability with the Open Document Format alternative. The company will announce July 6 that it has set up an open-source project to create a series of tools that allow translation between the OpenXML format and the ODF format, and which will be developed with partners. The Open XML Translator project, as it is known, will be posted on SourceForge, the open-source software development Web site.”

Wow! Microsoft using SourceForge… is the world ending?

A new study and recommendation by the network security form, Sophos suggests that the best way for home users to enjoy real network security and freedom from malware is to use a Mac! I would argue that the same thing could be accomplished by using a Linux box, but I guess that they were looking at only “supported” (by a company) systems. Linux is supported by the Open Source community, and you can also buy support from most major Linux vendors, but I digress. The important point here is that to truly avoid malware, simply avoid using Windows. Big surprise!

Sophos: because of malware home users should switch to Macs

“Sophos has published new research into the past six months of cyber crime. The Sophos Security Threat Management Report Update reveals that while there has been a vast drop in new viruses and worms, this has been over-compensated by increases in other types of malware, as cyber criminals turn their attention to stealing information and money. Most interestingly, new Trojans now outweigh viruses and worms by 4:1, compared to 2:1 in the first half of 2005. In addition, the continued dominance of Windows-based threats has prompted Sophos to suggest that many home users should consider switching to Apple Macs, to shield themselves from the malware onslaught.”

What is “FreeDOS” you say? Well, as it’s name implies, it is a free and Open Source version of the old, venerable DOS that we all used to love/hate! Microsoft long ago threw in the towel on DOS, but there are some old “die-hards” out there that still run it. FreeDOS has provided a free and open version for us “old fogies” to use when necessary… but there was a rumor of late that FreeDOS has died unceremoniously and was no more! Au contraire!

Free DOS Lives!

It seems not only that the project is continuing, they are getting ready to release the “1.0” version, a milestone in most Open Source projects! Hooray for FreeDOS!

FreeDOS Website