[NA]WannaCry/EternalBlue[NA]

[Let'sgoflying!]

I guess I don't understand how a "sleeper" virus would execute from the backed up file itself, unless that file was an executable or contained a macro.

John, I feel that if a computer can maintain a clock, it could likely activate software (ransomware) in that computer at any time in the future. If a backup can store software (or software disguised as data) then a backup could contain ransomware but I am not a techie.

Even then, it would execute from the computer that accessed it, not the storage location.

Do not computers connect to the storage location on a regular basis?

 

[John221us]

John, I feel that if a computer can maintain a clock, it could likely activate software (ransomware) in that computer at any time in the future. If a backup can store software (or software disguised as data) then a backup could contain ransomware but I am not a techie.


Do not computers connect to the storage location on a regular basis?

There are such animals as sleeper virus's, but they would live in an executable, such as a macro in in a word file (this is why macros are disabled by default). I guess in that sense, you could have infected data in the storage location. It might be possible for such a virus to then encrypt other files, when the computer accesses the file, again, after a certain date, but then the act of encrypting (that is how Ransomware works), would happen at the time of that second access, therefore, you could recover from the previous days backup. That said, you would then have to clean up the infected files, to prevent another occurrence.

 

[wsuffa]

There are such animals as sleeper virus's, but they would live in an executable, such as a macro in in a word file (this is why macros are disabled by default). I guess in that sense, you could have infected data in the storage location. It might be possible for such a virus to then encrypt other files, when the computer accesses the file, again, after a certain date, but then the act of encrypting (that is how Ransomware works), would happen at the time of that second access, therefore, you could recover from the previous days backup. That said, you would then have to clean up the infected files, to prevent another occurrence.

Unless the backup is residing on a drive easily accessible by the infected computer. Many folks simply like the network drive, leave it linked, and go forward - in that case, it merely looks like a drive on the system... and it will get infected.

Certain backup programs don't require a drive letter to connect - they can use the network name and store (or you put in) the credentials to log on to the device. That's much safer.

 

[CT4ME]

BTW... Here's something that has done more than anything to protect many of our clients... Get away from POP email! Probably imap too. Most POP email systems have little to no virus/malware or spam protection. Microsoft O365 mail and Google's G-suite (even Gmail accounts) have great protection. No, it's not perfect, but 1,000 times better than your average POP service. We have many clients that used to have daily occurrences of malware and viruses. After we switched them to O365 or G-apps, the problems went to near ZERO. Yes, we cut ourselves out of a lot of work, but it's the right thing to do! Besides, POP is an ancient system that was not designed to work for our modern needs.

 

[RJM62]

Sure there is.



Note the key here is that Rich is copying files to an OS that can't be infected / affected the same way the desktops can. This can be done with Linux, or a NAS that isn't Windows-based and isn't vulnerable, or a cloud service.

The key here is that (outside of PDFs, kinda... long story) unless they're replaced on the fly with executables, data files can't contain a virus.

Unless the file is replaced by the Windows machine with the virus before being copied to the off-machine storage, and then executed when copied back, and the other storage has no nothing scanning it for viruses, using a remote filesystem to "lie in wait" would be very difficult.

Now a nasty little thing to do would be for the infected Windows machines to reach out to the file server and erase or modify files on it, but that's what backups and audit/rate limits for changes (of the shared filesystem and regular scanning of that filesystem -- more often than the backup schedule -- are for.) ;-)

All of the above can be accomplished say, with something like a Synology NAS device if you'd rather spend money than time to cover it and not learn Linux. They even build in the software to do easy off-site backups to various cloud vendors. Some of those vendors have the ability to "never erase" as someone else mentioned, so even if someone or something erased or modified files on the Synology. (Other NAS systems probably do too, but I've used the Synology.)

But you do pay for the bandwidth and storage costs off site for however long you want to keep old stuff.

I should have added that the backups on the Linux machine / NAS would have to be versioned to be effective. But that part could be done on the Windows machine using Macrium or whatever. All the Linux machine is doing is accepting the connections, storing the backups, and then copying them over to a directory not accessible by the Windows machines.

Because of the versioning, it wouldn't matter if infected and/or encrypted backups were copied over. They wouldn't infect the Linux machine (or NAS), and the previous versions would be clean.

Rich

 

[RJM62]

BTW... Here's something that has done more than anything to protect many of our clients... Get away from POP email! Probably imap too. Most POP email systems have little to no virus/malware or spam protection. Microsoft O365 mail and Google's G-suite (even Gmail accounts) have great protection. No, it's not perfect, but 1,000 times better than your average POP service. We have many clients that used to have daily occurrences of malware and viruses. After we switched them to O365 or G-apps, the problems went to near ZERO. Yes, we cut ourselves out of a lot of work, but it's the right thing to do! Besides, POP is an ancient system that was not designed to work for our modern needs.

Or you could just install antivirus / antispam software on the mail server. It takes about a minute.

Rich

 

[CT4ME]

99% of POP mail users don't control their server.

 

[RJM62]

99% of POP mail users don't control their server.

Fair enough.

I personally wouldn't think of not running antivirus / antispam on a public mail server, but I guess I'm in the minority. I guess too many people figure that Linux is relatively bulletproof without considering that the downstream machines probably aren't.

Rich

 

[denverpilot]

Nate, I appreciate your optimistic approach to 'it can be done', but with all the privisos, exceptions, learning this, costs for that noted in your email I stand by my comment that this is not something that the average small (<$1M) business can accomplish.

$500 with two brand new 3TB drives, man. RAID 1 the two drives and plug it into a UPS if you want it to stay up "all the time". (Synology releases patches about once a month. Not all are useful or required, depending on what other software you're using on them. Side benefit... the thing also just became your streaming music server for the office. LOL... they even have their own -- albeit not the smartest -- Dropbox clone that can sync directories from user machines to directories on the NAS).

Synology DS216+II NAS DiskStation, Diskless

https://www.amazon.com/dp/B01EMQYGWA/ref=cm_sw_r_cp_tai_Zn5gzbYASK7ZZ

You make it a network file share for windows machines and you make folks put important files on it.

You get an Amazon S3 bucket, or Glacier bucket (I like the versioning on the S3 bucket better) and tell the Synology to back up to it.

As Rich said, you can use something on the windows machines (or manual copies) to version on the local Synology.

If you think you need that much versioning.

Nightly versions on the S3 bucket with the ability to restore them back to the Synology with again, point and click, is probably enough for most small place's really important files.

All point and click, no Linux knowledge required. And you gained solid backups of important files both on and off site in $500 plus maybe $20/mo at Amazon if you filled the entire 3TB mirrored drive pair. More like $5 for a non-full filesystem.

BTW... Here's something that has done more than anything to protect many of our clients... Get away from POP email! Probably imap too. Most POP email systems have little to no virus/malware or spam protection. Microsoft O365 mail and Google's G-suite (even Gmail accounts) have great protection. No, it's not perfect, but 1,000 times better than your average POP service. We have many clients that used to have daily occurrences of malware and viruses. After we switched them to O365 or G-apps, the problems went to near ZERO. Yes, we cut ourselves out of a lot of work, but it's the right thing to do! Besides, POP is an ancient system that was not designed to work for our modern needs.

The transports (POP, IMAP) have absolutely nothing to do with whether or not the vendor provides quality spam, malware/phishing detection, and virus filters at the server. Even GMail/ GSuite supports POP transport if you turn it on.

It's the quality of the provider and how well they run their mail servers, and isn't related at all to what transportation protocol is used between the server and the client.

All sorts of mail servers out there are "naked" and expect you to handle the virus and other problems at the client. They're cheap. Really cheap. Adding server side virus scanning, malware scanning, and phishing detection, isn't all that expensive though.

As far as cloud type vendors go, all of them have some sort of protection layer in their systems, but many give no user, or no admin access to tweak them and/or they're known as being fairly ineffective (hairy eyeball looking at O365 here...). Google is probably the most solid, but you can buy cloud based scanning through various security vendors for your inbound and outbound mail to travel through before and after your choice of "naked" mail server, also. All sorts of options.

I will admit, I know Rich doesn't like the evil Borg at Google, but linking our Active Directory for user auth to GSuite and using them for mail, was the best IT decision, behind moving servers to AWS, that we've made in years. The few times a message has gone "missing" a quick look in the audit logs reveals... "Yeah, every user sending from that little company today has attached malware. You might want to let them know, that's why we aren't receiving anything from them. Want me to send over the logs so you can send them a copy? It shows what they're infected with. Okay, thanks, bye."

Now we are playing with Google's Team Drive stuff where Amazon S3 and other AWS tools aren't the correct solution. (S3 is bloody amazing for server farms.) It's pretty good. It goes from just "pretty good" to "oh hell yes" when we factor in maintenance and sysadmin chores of a local box to do similar functionality.

 

[RJM62]

$500 with two brand new 3TB drives, man. RAID 1 the two drives and plug it into a UPS if you want it to stay up "all the time". (Synology releases patches about once a month. Not all are useful or required, depending on what other software you're using on them. Side benefit... the thing also just became your streaming music server for the office. LOL... they even have their own -- albeit not the smartest -- Dropbox clone that can sync directories from user machines to directories on the NAS).

Synology DS216+II NAS DiskStation, Diskless

https://www.amazon.com/dp/B01EMQYGWA/ref=cm_sw_r_cp_tai_Zn5gzbYASK7ZZ

You make it a network file share for windows machines and you make folks put important files on it.

You get an Amazon S3 bucket, or Glacier bucket (I like the versioning on the S3 bucket better) and tell the Synology to back up to it.

As Rich said, you can use something on the windows machines (or manual copies) to version on the local Synology.

If you think you need that much versioning.

Nightly versions on the S3 bucket with the ability to restore them back to the Synology with again, point and click, is probably enough for most small place's really important files.

All point and click, no Linux knowledge required. And you gained solid backups of important files both on and off site in $500 plus maybe $20/mo at Amazon if you filled the entire 3TB mirrored drive pair. More like $5 for a non-full filesystem.



The transports (POP, IMAP) have absolutely nothing to do with whether or not the vendor provides quality spam, malware/phishing detection, and virus filters at the server. Even GMail/ GSuite supports POP transport if you turn it on.

It's the quality of the provider and how well they run their mail servers, and isn't related at all to what transportation protocol is used between the server and the client.

All sorts of mail servers out there are "naked" and expect you to handle the virus and other problems at the client. They're cheap. Really cheap. Adding server side virus scanning, malware scanning, and phishing detection, isn't all that expensive though.

As far as cloud type vendors go, all of them have some sort of protection layer in their systems, but many give no user, or no admin access to tweak them and/or they're known as being fairly ineffective (hairy eyeball looking at O365 here...). Google is probably the most solid, but you can buy cloud based scanning through various security vendors for your inbound and outbound mail to travel through before and after your choice of "naked" mail server, also. All sorts of options.

I will admit, I know Rich doesn't like the evil Borg at Google, but linking our Active Directory for user auth to GSuite and using them for mail, was the best IT decision, behind moving servers to AWS, that we've made in years. The few times a message has gone "missing" a quick look in the audit logs reveals... "Yeah, every user sending from that little company today has attached malware. You might want to let them know, that's why we aren't receiving anything from them. Want me to send over the logs so you can send them a copy? It shows what they're infected with. Okay, thanks, bye."

Now we are playing with Google's Team Drive stuff where Amazon S3 and other AWS tools aren't the correct solution. (S3 is bloody amazing for server farms.) It's pretty good. It goes from just "pretty good" to "oh hell yes" when we factor in maintenance and sysadmin chores of a local box to do similar functionality.

ioSafe makes NAS units running Synology, and they're waterproof and fireproof with data-recovery warranties, as well. They're part of any recommendation I make to clients for whom online backup is impractical (slow DSL connection, data caps, etc.). Thoughtfully located, they're about as close to online backup as local backup gets in terms of being disaster-proof. Very high-quality devices and people, in my experience. They're a bit pricey for a mom and pop outfit's budget, but nowhere near as expensive as losing all their data would be.

As for Google, other than their penchant for snooping, my biggest gripe was slow mail processing. When a few of my clients decided to offload their mail service to Google a few years ago, I was actually giddy with glee because they happened to have huge mail needs. I was more than happy to make a few DNS entries and be done with it.

I wasn't so happy when they called me with their complaints instead of calling Google. Incoming mail was always delayed for anywhere from a few minutes to a few hours, which was unacceptable when someone was on the phone with an engineer or architect waiting for a drawing to come in so they could look at it together. And no matter how many times I tried to explain to them that Google, not I, was their mail provider, they kept calling me to complain about slow mail.

I suppose they've improved since then. I'm also told that their paying clients aren't subject to the same snooping that Gmail users are.

Personally, if I were going to farm out the mail, I'd use Fastmail. I don't think anyone does it as well as they do. Netaddress is also very good, but they do tend to have an outage once or twice a year.

Another up-and-coming backup resource is Backblaze B2. Crazy-cheap storage and uploads with rather expensive downloads. I'm gradually moving all my doomsday backups to B2. They only have one datacenter last time I checked, but that doesn't bother me for a doomsday destination. It's always a tertiary or quaternary destination, so the primary and secondary (and possibly the tertiary) would have to fail before I needed those backups. If their datacenter happened to burn to the ground that same day, then I guess I'd have to chalk it up to some seriously bad karma.

Rich

 

[CT4ME]

I wasn't impugning POP, per se, but companies that give you "free" email accounts, like your normal Internet service providers (cox,comcast,centurylink, etc). Or the email that typically comes with your domain name and hosting. All of them usually give you crappy, ancient, un-filtered email. But, regardless of filtering, POP shouldn't be used anymore anyway. It was never designed for our new mobile, multi-device lifestyles.

 

[denverpilot]

GSuite is super fast on delivery... we haven't seen anything yet that was slower than running our own mail server. But paid vs unpaid may make a difference.

Neat gadget, that thing repackaging Synology's stuff.

Fastmail and Backblaze are both awesome.

I really worried about Fastmail when Opera bought them, thinking that would be their demise, but it wasn't. They offer crazy things no other mail provider does, too. I remember thinking, "Why would I want FTP access to my email?" way back in the day. LOL. Doubt they still do that one, but talk about creative.

 

[RJM62]

GSuite is super fast on delivery... we haven't seen anything yet that was slower than running our own mail server. But paid vs unpaid may make a difference.

Neat gadget, that thing repackaging Synology's stuff.

Fastmail and Backblaze are both awesome.

I really worried about Fastmail when Opera bought them, thinking that would be their demise, but it wasn't. They offer crazy things no other mail provider does, too. I remember thinking, "Why would I want FTP access to my email?" way back in the day. LOL. Doubt they still do that one, but talk about creative.

Fastmail also runs the most trouble-free calendaring system I've ever used. You'd think that all CalDAV servers would be pretty much the same, but they're not. I've never had an appointment disappear or get doubled up on Fastmail, and the synchronization is immediate and flawless. Just the calendaring alone is worth upgrading from their free package.

Rich

 

[jim.nelson]

But, regardless of filtering, POP shouldn't be used anymore anyway. It was never designed for our new mobile, multi-device lifestyles.

Over my career I've moved jobs several times and I find it useful to keep ALL my email. Having it live on company servers means I can't take it with me. Using POP I have email downloaded from company servers all the way back in 1997. It's been useful to keep a paper trail from two jobs ago. I also have the peace of mind that my emails are downloaded and removed from the company servers. Yeah, I can't see emails from yesterday on my phone but that's never been a big issue. YMMV.

 

[denverpilot]

I also have the peace of mind that my emails are downloaded and removed from the company servers.

Any company paying attention to anything is archiving all inbound and outbound mail these days. You've removed YOUR copy, I've made sure the company still has theirs.

 

[Frogs97]

I don't see feasible preventive measures for a small business.

SentinelOne and Datto are a pretty great 1-2 punch that are very feasible and effective for SMBs.

 

[RJM62]

Over my career I've moved jobs several times and I find it useful to keep ALL my email. Having it live on company servers means I can't take it with me. Using POP I have email downloaded from company servers all the way back in 1997. It's been useful to keep a paper trail from two jobs ago. I also have the peace of mind that my emails are downloaded and removed from the company servers. Yeah, I can't see emails from yesterday on my phone but that's never been a big issue. YMMV.

I like POP too, although for different reasons. I simply prefer storing my mail locally rather than on public servers that are more attractive targets for miscreants. Of course, that brings risks of its own (especially using Windows), so it's a mixed bag. I also have only two devices that routinely check mail. If I had more, I might feel differently.

For future reference, however, you can in fact download and store mail locally using IMAP. On Thunderbird, for example, you can just move it to a local folder. On Outlook you can export it as a .PST file. Some clients can also be configured to connect using IMAP, but to save the mails locally and delete them remotely by default. To me, however, that begs the question of why one wouldn't just use POP if that's what they want to happen.

Rich

 

[Skyrys62]

I do a few things where I work...and even a small business can do this cheaply.

I have one computer as a backup only computer. It has a few drives in it.
One set of drives runs a script I wrote using Robocopy for Mon, Tues, Wed, Thurs, 1st Friday, 2nd Friday, 3rd Friday, 4th Friday, 5th Friday, and January thru December. Every Monday, the files get written over. Same for the others...but it offers weeks, then months, then a year of backups.
Using a script, you can set these up as scheduled tasks relatively east.
Another set of drives (and scripts) only backups up the changed files each day. (separate from the other backups). Every month I archive these to DVD's and store.
I also have a daily offsite backup service and it keeps a rolling 30 days of backups.
so I am covered.
Other than the offsite storage, and a monthly DVD (.20 cents)... I pay nothing.

Something that I did not see mentioned here yet, and is VERY important... do not allow any of your users to map drives to the servers\storage.
Also try to keep administrator permissions at a minimum.
We got hit with crytolocker due to one person having a mapped drive. Our CEO of all people.
Glad it was the CEO. Anyone else would have been in trouble!

 

[RJM62]

I do a few things where I work...and even a small business can do this cheaply.

I have one computer as a backup only computer. It has a few drives in it.
One set of drives runs a script I wrote using Robocopy for Mon, Tues, Wed, Thurs, 1st Friday, 2nd Friday, 3rd Friday, 4th Friday, 5th Friday, and January thru December. Every Monday, the files get written over. Same for the others...but it offers weeks, then months, then a year of backups.
Using a script, you can set these up as scheduled tasks relatively east.
Another set of drives (and scripts) only backups up the changed files each day. (separate from the other backups). Every month I archive these to DVD's and store.
I also have a daily offsite backup service and it keeps a rolling 30 days of backups.
so I am covered.
Other than the offsite storage, and a monthly DVD (.20 cents)... I pay nothing.

Something that I did not see mentioned here yet, and is VERY important... do not allow any of your users to map drives to the servers\storage.
Also try to keep administrator permissions at a minimum.
We got hit with crytolocker due to one person having a mapped drive. Our CEO of all people.
Glad it was the CEO. Anyone else would have been in trouble!

You may want to look into rclone if you're not already using it. You can run it from a Windows batch file after robocopy to save the changed files online to Backblaze B2 or many other destinations. There's also a Linux version. I have it set up as a cron job on all my servers to copy the archived daily backups to Backblaze B2 as doomsday backups (in addition to my local backups and snapshots, which are stored at the DC).

Rich

 

[Skyrys62]

Good advice!

I though you would use Richcopy

 

[denverpilot]

Something that I did not see mentioned here yet, and is VERY important... do not allow any of your users to map drives to the servers\storage.
Also try to keep administrator permissions at a minimum.
We got hit with crytolocker due to one person having a mapped drive. Our CEO of all people.
Glad it was the CEO. Anyone else would have been in trouble!

We don't mind drive mapping at all. The trick is in how often to back up and version the backups and set expectations. The most our company is willing to pay for is a reset to "yesterday".

I'd also like to know the rest of the story about how a cryptolocker executed on the CEOs (or anyone's) machine without them clicking on it and then clicking on the warning that they shouldn't run it and then clicking on the last approval from the elevated privilege warning.

If the CEO had admin rights on a Windows desktop, that's flat wrong. Nobody gets admin rights, and if they do because "politics" they are told they're breaking both our customer's security policies for us (so their elevated privilege will have to be reported in the next security audit) and they're also reminded their user can now destroy a LOT of important data and they can trigger the whole "roll back to yesterday" doomsday scenario for themselves at the least, and anyone else who clicks on stuff their machine saved on the network shares.

If they still think they're so important they're worth risking all of that, and their boss (or in the CEOs case, they're willing to answer to the owner as to why they refused to follow privilege elevation policy) we don't argue too much harder. They get it. It's their career they're betting against.

There's two engineering level people who have successfully argued to their bosses they need it. And we're cool with that. The ones who'll bet the company on stuff and can convince their bosses they're worth doing so for, usually make or save the company enough money, that they're right. They'd even help clean up the mess if it happens to them.

After being properly framed and expectations set of how much damage admin rights can cause, NONE of our CxOs even ask for it. And only one crazy nut in Sales who's been repeatedly denied by his bosses.

 

[Skyrys62]

Ahhhhh... I wish it were that easy here.
The stories are many, and some almost unbelievable.
and yes, the CEO clicked a link and probably answered yes to anything that popped up. We wiped that machine, re-imaged, made sure no one else had any mapped drives...as it was the only way crytolocker got to our server.
I had a lot of leverage after cleaning up the mess... for a while.
But they are a recidivistic lot.
However, I have warned them.....yet again.
about 2-3 more years and I'm retiring (hopefully) so they can have it as they will.

 

[sferguson524]

Microsoft's official word today on this is that the hack is directly traceable back to NSA-found holes in the OS, and NSA didn't warn them of the hole, or they would have patched it. Your government at work... and your OS vendor... high quality there... well worth the money on both parts...

Some bad guys don't care in the slightest about being "bad players"... there will be variants of this made that simply encrypt and the ransom links lead nowhere, just "because".

Car hacking has been successfully shown for a number of years at DEFCON now, without access to source... YMMV on how well you think the hacks work, or whether the auto makers are keeping up with it, but older stuff is completely vunerable with no upgrade/patch path...

And then the question becomes... do you want your car to join the world of never-ending security patches and the "software of the month club" that everything else has migrated to? It requires "always on" network connectivity or at least a car smart enough to attach to your home WiFi, and software engineers haven't exactly set a high bar for quality on new products being attached to the Internet in the whole "IoT world"...

Network attached OS quality is about as low as it's ever been, measuring by number of remote exploits and patches... but throw more connectivity at a team/entire industry (cars) who don't "do" Internet and think they'll get ANYTHING right about it? ROFL... it'll sure be an entertaining crap-show for a while...

The car we are building is fully integrated with IoT.... it scares the bejabbers out of me

 

[sferguson524]

Sure there is.



Note the key here is that Rich is copying files to an OS that can't be infected / affected the same way the desktops can. This can be done with Linux, or a NAS that isn't Windows-based and isn't vulnerable, or a cloud service.

The key here is that (outside of PDFs, kinda... long story) unless they're replaced on the fly with executables, data files can't contain a virus.

Unless the file is replaced by the Windows machine with the virus before being copied to the off-machine storage, and then executed when copied back, and the other storage has no nothing scanning it for viruses, using a remote filesystem to "lie in wait" would be very difficult.

Now a nasty little thing to do would be for the infected Windows machines to reach out to the file server and erase or modify files on it, but that's what backups and audit/rate limits for changes (of the shared filesystem and regular scanning of that filesystem -- more often than the backup schedule -- are for.) ;-)

All of the above can be accomplished say, with something like a Synology NAS device if you'd rather spend money than time to cover it and not learn Linux. They even build in the software to do easy off-site backups to various cloud vendors. Some of those vendors have the ability to "never erase" as someone else mentioned, so even if someone or something erased or modified files on the Synology. (Other NAS systems probably do too, but I've used the Synology.)

But you do pay for the bandwidth and storage costs off site for however long you want to keep old stuff.

This... Amazon Glacier is so dirt cheap for storage, it's a no brainer

 

[sferguson524]

We don't mind drive mapping at all. The trick is in how often to back up and version the backups and set expectations. The most our company is willing to pay for is a reset to "yesterday".

I'd also like to know the rest of the story about how a cryptolocker executed on the CEOs (or anyone's) machine without them clicking on it and then clicking on the warning that they shouldn't run it and then clicking on the last approval from the elevated privilege warning.

If the CEO had admin rights on a Windows desktop, that's flat wrong. Nobody gets admin rights, and if they do because "politics" they are told they're breaking both our customer's security policies for us (so their elevated privilege will have to be reported in the next security audit) and they're also reminded their user can now destroy a LOT of important data and they can trigger the whole "roll back to yesterday" doomsday scenario for themselves at the least, and anyone else who clicks on stuff their machine saved on the network shares.

If they still think they're so important they're worth risking all of that, and their boss (or in the CEOs case, they're willing to answer to the owner as to why they refused to follow privilege elevation policy) we don't argue too much harder. They get it. It's their career they're betting against.

There's two engineering level people who have successfully argued to their bosses they need it. And we're cool with that. The ones who'll bet the company on stuff and can convince their bosses they're worth doing so for, usually make or save the company enough money, that they're right. They'd even help clean up the mess if it happens to them.

After being properly framed and expectations set of how much damage admin rights can cause, NONE of our CxOs even ask for it. And only one crazy nut in Sales who's been repeatedly denied by his bosses.

I used to have a PD (Practice Director) come in and demand DA rights on the network because he thought he could manage Exchange and AD better than me and the rest of IT. He got laughed out of the office on the regular with threats of firing us all (he didn't have the power.) One day i told the IT director i was going to take snapshots of all the VMs and give him what he asked for, so he could answer to the CEO when he broke something.. Sadly I was rebuffed.

 

[wsuffa]

The car we are building is fully integrated with IoT.... it scares the bejabbers out of me

Certain manufacturers have already had to patch onboard systems for security issues. Connecting mobile systems to the outside environment raises the risk substantially (IoT, even on-star). Cars have turned into data collection devices and some have "phone home" modes - and don't think for a moment the data and access is limited to the car manufacturer.

It's no real secret that certain governments have researched and developed systems to disrupt car electronics system ("kill devices") - as cars become more reliant on computers. The idea is to get around any emi protections. IoT or similar connectivity just makes it easier.

https://www.rt.com/news/remote-car-disable-eu-413/

https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

 

[denverpilot]

"A Patriarch of the Russian Orthodox Church blessing Russian government computers to protect them against the WannaCry ransomware attack. He also sprinkled holy water on the computers themselves."

ROFLMAO... wish I were kidding, but... nope...

 

[sferguson524]

That's what I do before i do SAN maintenance..

 

[John221us]

We have a few rubber chickens laying around for emergencies.

 

[wsuffa]

"A Patriarch of the Russian Orthodox Church blessing Russian government computers to protect them against the WannaCry ransomware attack. He also sprinkled holy water on the computers themselves."

ROFLMAO... wish I were kidding, but... nope...

Don't think it doesn't happen here - I witnessed a TV preacher pour "Holy Water" on the base of a TV tower hoping to ward off the evil landlord and the FCC.

 

[Palmpilot]

all the old windows not supported now are at risk.....still a ton of XP out there.....I would be upgrading asap

Wonder of wonders, Microsoft has released WannaCrypt-related security updates for some of the no-longer-supported operating systems, including XP.

https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

With all the talk about moving to a subscription model, I bet they could make significant money by selling security update subscriptions to the public, not just to custom-support customers. Personally, I'd be willing to pay at least a hundred bucks a year if it meant I could stay with Windows 7 past the scheduled end-of-support date. There are A LOT of people still hanging onto Windows 7.

 

[John221us]

Wonder of wonders, Microsoft has released WannaCrypt-related security updates for some of the no-longer-supported operating systems, including XP.

https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

With all the talk about moving to a subscription model, I bet they could make significant money by selling security update subscriptions to the public, not just to custom-support customers. Personally, I'd be willing to pay at least a hundred bucks a year if it meant I could stay with Windows 7 past the scheduled end-of-support date. There are A LOT of people still hanging onto Windows 7.

Ultimately, you will still run into support issues, not just from MS. On Win XP, hardware vendors no longer create or update drivers for that OS, so if your hardware fails, you will need to install to a VM or rebuild from scratch. This is also true if you are looking to install an updated video card or something similar. At some point, the world marches on and you need to move forward.

 

[Palmpilot]

Ultimately, you will still run into support issues, not just from MS. On Win XP, hardware vendors no longer create or update drivers for that OS, so if your hardware fails, you will need to install to a VM or rebuild from scratch. This is also true if you are looking to install an updated video card or something similar. At some point, the world marches on and you need to move forward.

When "the world marches on" to such a degree that compatible products are not even available on the used market, it generally means that the new stuff is achieving a high degree of user satisfaction. When that happens, I don't have a problem with upgrading. From what I've heard, Windows 10 is not there yet.

 

[John221us]

When "the world marches on" to such a degree that compatible products are not even available on the used market, it generally means that the new stuff is achieving a high degree of user satisfaction. When that happens, I don't have a problem with upgrading. From what I've heard, Windows 10 is not there yet.

Windows 10 has a great adoption rate. It's current market share is 26.28% of all desktop OS's. Windows 7 is at 48.5% and Windows 8.1 and Windows XP are tied at about 7%. In the corporate world, we are not seeing the push back on Windows 10 (like we did with Windows 8 and Windows Vista).
https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0

 

[Palmpilot]

Windows 10 has a great adoption rate. It's current market share is 26.28% of all desktop OS's. Windows 7 is at 48.5% and Windows 8.1 and Windows XP are tied at about 7%. In the corporate world, we are not seeing the push back on Windows 10 (like we did with Windows 8 and Windows Vista).
https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0

That's all well and good, but Windows 7 is still the dominant operating system by nearly a factor of two. I'm thinking that's too large a market for makers of peripherals and software to ignore.

 

[l8evator]

Anyone interested in buying a 1946 Champ? There are two wires to control the two magnetos and each magneto has four wires for spark plugs. Do we have to count the cables connecting the heel brake pedals to the brake actuators as wires? I'm going with no on that one. No backup though, you just have to get out and push it back (note: turn magnetos off before pushing back). There have been a number of version updates but you had to buy new hardware so not updated. There isn't much security either. No key required for that magneto switch and the door lock, while it may have had a key at some point . . . But the windows are good.

 

[denverpilot]

... I bet they could make significant money by selling security update subscriptions to the public, not just to custom-support customers.

Should just be fined heavily for being the number one proliferator of problems on the Internet through their gross negligence in writing OS code so poorly it needs monthly updates.

 

[murphey]

View attachment 53601

"A Patriarch of the Russian Orthodox Church blessing Russian government computers to protect them against the WannaCry ransomware attack. He also sprinkled holy water on the computers themselves."

ROFLMAO... wish I were kidding, but... nope...

At a local university in the early 90s, asbestos was discovered in the building that housed the CS & Math depts. Everyone cleared out over the summer for cleanup. When we came back, we had a Rabbi, a Father, an Iman, a couple of nuns, and everyone else we could find to bless everything in the building, over the labs, over the actual computers, the servers, everything. We even printed up a booklet with the many and varied prayers and blessings. One of my favorite was the one over the water fountain on the first floor. School finally took the time to repair the plumbing that kept flooding one of the labs.

 

[denverpilot]

At a local university in the early 90s, asbestos was discovered in the building that housed the CS & Math depts. Everyone cleared out over the summer for cleanup. When we came back, we had a Rabbi, a Father, an Iman, a couple of nuns, and everyone else we could find to bless everything in the building, over the labs, over the actual computers, the servers, everything. We even printed up a booklet with the many and varied prayers and blessings. One of my favorite was the one over the water fountain on the first floor. School finally took the time to repair the plumbing that kept flooding one of the labs.

I just stick to the Astronaut's Prayer for most of my activities in tech and airplanes, with thanks to Alan Sheppard.

 

[RJM62]

I just stick to the Astronaut's Prayer for most of my activities in tech and airplanes, with thanks to Alan Sheppard.

That, and have good backup. https://www.backupnut.com

Rich