Passwords, why are they so complicated????

I get questions and complaints about password all the time. Many people don't like having long passwords because they create long passwords that they have trouble remembering. Their solution is to write it down or make it so simple that it could easily be guessed with very little digging. My response to them is always the same. If you are comfortable going on vacation for a week and leaving your front door wide open, then you probably don't have to worry about your password.


Good Passwords
A good password:
Has both upper and lower case letters
Has digits and/or punctuation characters as well as letters
Has Special Characters if allowed (@#$%^&*!....)
Is easy to remember, so they do not have to be written down
Is seven or eight characters long
Can be typed quickly, so someone else cannot look over your shoulder

While the details vary from one system to another, a password that is:

up to 8 characters long, and
has at least three letters, and
has at least two characters which are not letters,
will work on most machines.

Do This
Make your password as long as possible. The longer it is, the more difficult it will be to attack the password with a brute-force search. Always use at least 7 characters in your password, at least two of which are non-alphabetic.
Use as many different characters as possible when forming your password. Use numbers, punctuation characters and, when possible, mixed upper and lower-case letters. Choosing characters from the largest possible alphabet will make your password more secure.
Change your password on a regular basis. Changing your password every 30 days is a good rule-of-thumb, and you should never go longer than 90 days before picking a new password. Do not reuse any previous password you have used. The longer you wait before changing passwords, the more difficult it will be to get used to the new one.


Do NOT Do This
Do not use personal information in your password that someone else is likely to be able to figure out. Obviously, things like your name, phone number, and address are to be avoided. Even names of acquaintances and the like should not be used.
Do not use words, geographical names, or biographical names that are listed in standard dictionaries.
Never use a password that is the same as your account number.
Do not use passwords that are easy to spot while you're typing them in. Passwords like 12345, qwerty (i.e., all keys right next to each other), or nnnnnn should be avoided.


Try This Trick
Good passwords don't have to be difficult to remember. If you are having difficulty picking a good password, one good method is to use the first letter of each word in a phrase you can easily remember. For example, "McDonald's is your kind of place" would be miykop.

Another method is to intentionally use misspelled words, or words with a number or punctuation mark suffixed. Examples include: braekfast, kite276, and weather. (the period at the end is part of the password). But, don't copy any of these examples!

One more example, The pass phrase. An example of a pass phrase is, " ILikeRockets2. This password is basically a sentence, meaningful to you but long enough that a brute force attack will take a long time. By the time the software used to attack your password were to guess it, more than the 90 days recommended to change your password would pass and you would, hopefully, have changed your password. The length and the time you keep a password are important pieces of the password puzzle. These are some good guidelines for making your passwords safe.


Common Mistakes
These are too easy to guess. Don't include them.
Your name
Your spouse's name
Your parent's name
Your pet's name
Your child's name
Names of close friends or coworkers
Names of your favorite fantasy characters
Your boss's name
Anybody's name
The name of the operating system you're using
The hostname of your computer
Your phone number
Your license plate number
Any part of your social security number
Anybody's birth date
Other information that is easily obtained about you
Words such as wizard, guru, gandalf, and so on.
Any username on the computer in any form (as is, capitalized, etc.)
A word in the English dictionary
A word in a foreign dictionary
A place
A proper noun
Passwords of all the same letter
Simple patterns on the keyboard, like qwerty
Any of the above spelled backwards
Any of the above followed or prepended by a single digit

Should Google Scare me?

Even as I type this, in the back of my mind I half expect to see some man in dark glasses come walking into my office asking me to step away from the keyboard..... Should I be afraid of Google?

So where does this come from. Laying awake one night, worring about the servers and businesses that I am responsible for, I came across a show that showcased Google. It brought up things, that frankly I never thought of. In today's "Internet required" lifestyle, everyone is tweeting and posting somethings that in the past would only be know between friends. Now, I can "Google" just about any comment or phrase and find information about people that I am sure would make the person think, why did I ever post that... I tell my kids, " The Internet is for ever...".

So should I have a healthy fear of Google.... No. Google is just good at its job. They provide us an easy access to the vast sea of information that we as users offer up willingly, for the most part. Do I think that Google has unlimited power... Yes, as the man standing outside my office window would have me tell you. Even with that, I would say that the problem with Google is not what they capture for all time, it is actually the users that offer up the information for all to see. If you don't want it to be known, in all corners of the globe, then don't commit it to the computer. It will be found. FOREVER!

So, in short, get of the back of Google and start taking responsibility for your own actions. Google never made you post that picture of the long night of drinking at that really great party that ended up with you wearing a lampshade and passed out on the lawn... If your wireless router is unsecured, blame no one but yourself, read the directions and setup a secure network, quit telling us what you are doing every 5 minutes... Oh I guess I am doing the same thing... huh... can I get this back?????

Buying a Laptop vs. a Desktop as a Family Computer

As a consultant, I am often approached with this question, "Would you get a Laptop or a Desktop", and I always follow that with the inevitable question, How do you use your computer?
This article written by Christy Matte gives you a good overview of questions to ask yourself when looking to replace your home computer.

Buying a Laptop vs. a Desktop as a Family Computer

When it comes time for your family to buy a new computer, you may find yourself torn between a desktop computer and a laptop. There are good reasons for both, so the final decision should be based on the specific needs of your family. Consider the following factors when doing your shopping.

Price
Generally speaking, you’re going to pay more for a laptop than a comparable desktop computer. Smaller components are more expensive and you will see that reflected in your price. If your family utilizes the computer mainly for word processing and internet use, a laptop might be a practical choice. However, video games, video editing and even desktop publishing require additional memory, storage and possibly high-end video and sound cards. Each of these will increase the cost and the weight of the machine.

Portability
Laptops are obviously more portable than desktops, so the more important question is whether or not your family needs portability. If you don’t have a dedicated space in your home for the computer, or if family members will want to use the computer in different rooms, a laptop is an ideal option. If you plan to move the computer infrequently, a desktop is a better buy for your money.

Upgrades/Repair
Although there are some things that can be upgraded/replaced in a laptop, it is just not as easy to keep up-to-date and in good repair as a desktop machine. This may or may not be a concern for your family. As desktop prices come down, it may actually be more cost effective to purchase a new computer, rather than trying to keep an older machine current. That said, if your laptop screen cracks or someone spills juice on the keyboard, it’s much more serious than similar damage on a desktop. If your household has young children, this is certainly something to keep in mind.

Ergonomics
Ergonomics refers to the design of a workspace so that it allows for a comfortable and safe experience for the user. In this case, there are specific attributes a computer workstation should have in order to minimize strain on the eyes, neck/back, wrists/hands, etc. Although it is possible to set a laptop up in such a way to be ergonomically sound, people rarely do so. It would involve, at the very least, an additional keyboard and a stationary workstation, which might defeat the purpose of having a laptop in your home.

Space
Desktop computers are getting smaller and smaller, while laptops get bigger. Still, a laptop will require a smaller footprint in your home. You can even tuck it away when you need more free counter or table space. When free space is at a premium, a laptop is a great option.
As you can see, the choice between a laptop and a desktop is specific to your household. There is no one right answer. However, using this guide will help you think through the lifestyle of your family and help you come to a solid decision.

Windows Presentation Foundation Terminal Server Print W has encountered a problem

For those of you using Easy print for your clients using RDP, I am sure many of you have seen this....

Windows Presentation Foundation Terminal Server Print W has encountered a problem and needs to close. We are sorry for the inconvenience.

Your documents print on your client machines but the error shows up every time. Searching Microsoft for a solution and still at wits end... Here is your fix!!!!

The problems lies with this file on your XP machines - TsWpfWrp.exe. This file is in the System32 folder. Downloading SP3 should have taken care of this issue but it doesn't. The fix is simple, though it requires access to TsWpfWrp.exe on a Vista or Windows 7 machine. Copy, don't remove, move, or delete, the file TsWpfWrp.exe from the Vista or Windows 7 machine. Rename the file on the XP machine to OLD_TsWpfWrp.exe or something to protect the original file. Paste the file into the original location on your XP machine. Done!

I have still not seen a patch for this and I am not sure why Microsoft has not fixed this yet I am sure they have their reasons. But this workaround has worked on every client machine I have! Stop beating yourself over the head with your keyboard. Enjoy!

Now my DISCLAIMER!!!

Note: This is a tip and YOU assume all the risk for monkeying around with system files.

Windows 7

By now, unless you live under a rock, you must have heard the buzz about Windows 7. Well let me say that you are going to love it. Not plagued by issues of Vista, Windows 7 is a fresh new OS that has a lot to offer. I love Windows 7!

Now for all of you that ar XP faithfuls, you must be skeptical. XP has been a friend to you for many years. You 've waited for a fresh alternative , THAT WORKS, and now your ready to upgrade...Now here is where the tears come. You will quickly find that there is no direct upgrade from XP to Windows 7. What??? How will you make the switch?

I am afraid to tell you that this will be a painful experience for those of you who have held on to you old applications that ran on XP. You will find yourselves searching your vendors for updates that you can run on the new OS. It will not be easy. Some of the programs will be able to run in compatibility mode, but many of the older DOS programs and Windows 98 programs that are still in use in some of the smaller offices will not. You will finder yourself trying to run them on a Virtual machine running XP or looking for alternatives to take the place of your aging software. Windows 7 Pro or Better even plan for that scenario. When finally released, there will be the Windows Virtual PC. This will allow for you to run XP Mode. But wait, a panacea amidst the turmoil? Why did I not tell you about this sooner. This will be great for those of you who have machines that can support virtualization. Many older, memory starved machines will not support this option. Look for future posts on the Windows Virtual PC

To those of you who find yourselves in this situation, it is time to realize, your ship is on fire, the fire-pump has failed and you must start looking for a way off. Plan now while you can. Don't just wait to replace your machines as they die off. Get help now before you find yourself in a situation that you have to have your IT Infrastructure reworked overnight. Plan your exit.

On the other hand, you can keep doing what you've done all these years and wait until its broke to fix it. There are those who think this is the best option. It may be cost prohibitive to change everything at once... Just take this warning... Change is coming... Make a plan...

Conficker/Downadup Exploiting Microsoft

Microsoft Vulnerability MS08-067 showcases the newest vulnerability found in the world of Microsoft. Conficker/Downadup is in the house! The worm targets all Microsoft OS platforms: Win95, Win98, Windows Me, NT, XP and Vista, along with Windows 2000, Windows Server 2003, Windows server 2008, and Windows 7 pre-beta.


The vulnerability was originally patched back in October after a private firm revealed it to Microsoft. Microsoft issued the Security Bulletin MS08-067 and pushed a patch in an out-of-band fix to try to head off the problem. This is a patch that gets pushed out immediately to everyone and not on the usual Patch Tuesday. The exploit takes advantage of the way netapi32.dll handles RPC requests and resides in the Windows Server service. Utilizing ports 139 and 445 to do its bidding, this service runs with System privileges, which is even higher than Administrator privileges. This gives it the potential for unlimited access.


The worm copies its executable to the Windows system directory, then creates a service to cause it to be run whenever Windows starts up and modifies the Registry. Once it's in, it starts infecting other machines by picking a TCP port and launching an HTTP server, getting other machines' IP addresses and attempting that buffer overrun. In this process, the worm undertakes a brute-force attack to gain access to the Administrator account. The buffer overruns, code is launched to download the worm, and the process of infection starts again. It can also spread by simply being passed along on someone’s portable storage device and by infecting network shares.

To keep it from being detected, it disables the services and notifications that could make note of its presence, even blocking access to any security-related Web sites that could flag the problem. The sites blocked are Windows Automatic Update Service, Background Intelligent Transfer Service (BITS), Windows Security Center Service, Windows Error Reporting Service and Windows Error Reporting Service. It also disables Windows Defender and blocks any Security center notifications. One other sneaky step it has to keep it alive and kicking is it flushes any System Restore points the user happens to have created on the machine, further disguising its presence. Finally, if it wasn’t smart enough, it calls out to search engines to find the latest copies of itself or whatever other payload its keepers have to offer. Payloads can be just about anything from spyware to collect bank account information to key loggers for collecting data for users id and passwords. Its potential, I am sure, has no limit.

It is estimated that the first variant of the worm was able to infect 500,000 machines due to an aggressive infection routine and a sophisticated exploitation algorithm, which makes use of geo-location and OS fingerprinting. There were flaws in the first variant of Downadup. It was able to spread only with one mechanism and it had a single point of failure, which was the data file used to perform geo-location of IP addresses. This file (GeoIP.dat.gz) was freely available on the Web back in November 2008 and was downloaded by the worm directly from the website using a hardcoded URL in its code. At some stage, MaxMind removed this GeoIP file from their website, probably because of the denial-of-service (DoS) effect they would have been experiencing on their servers, which were being contacted by all machines infected by Downadup. This change somehow affected the exploitation abilities of the first variant.

The new variant came out in the latter part of December 2008. It was able to copy across USB and/or network drives and could also infect machines by brute-forcing user passwords, all of which dramatically increased its ability to spread. In addition, the authors fixed the GeoIP problem from the first variant by inserting the GeoIP file directly into the appended data of the threat file. This data is decrypted and decompressed in memory on-the-fly by the malware, and then re-encrypted to avoid memory forensics.

Signs that you might be infected would be the usual. Machines are sluggish. However, it is smart enough to wait for system idle time to keep itself from being noticed easily. System resources are the prize for this worm. It might become evident when you notice your machine is just not running as fast.

So what is our lesson? The Conficker/Downadup Worm is a wake up call that now is the time for a security audit. Update your OS and antivirus software definitions often. Make sure your firewall is intact. Prevention is always worth the time it takes.

Expanding Business

A new edition to the West Texas IT Service territory. We have expanded our coverage to include North Texas by adding an office in the city of Muenster, Texas. We are offering the same great service that was started in Amarillo. Now North Texas has a computer support staff!

I have also recently placed 3rd place, out of 1800+ contestant, in the US and Canada in a Contest run by IBM called the Master the Mainframe contest. It is a contest designed to sharpen the skills of those who have an interest in the mainframe as a platform. So I have added some mainframing skills to my belt. Thank you IBM!