Category: None

Data Reliance

As we become a more technologically evolved society, our reliance on data increases.  E-Mail, web access, electronic documents, bank accounts, you name it.  The loss of any one of these can have devastating consequences, from loss of productivity, to loss of home, health, or even, in extreme cases, life.

Unfortunately, I get to experience this first hand.  At the beginning of the week, there was a failure on the shared system I access at work.  Initially it seemed this was merely a permissions issue, we had just lost access to the files for a short time.  However, as time passed, we learned that the reality of the situation was much worse.

Like most companies, we rely heavily on shared drive access for collaboration and storage.  Of course, this means that the majority of our daily work exists on those shared drives, making them pretty important.  Someone noticed this at some point and decided that it was a really good idea to back them up on a regular basis.  Awesome, so we’re covered, right?  Well, yeah..  sort of, but not really.

Backups are a wonderful invention.  They ensure that you don’t lose any data in the event of a critical failure.  Or, at the very least, they minimize the amount of data you lose..  Backups don’t run on a constant basis, so there’s always some lag time in there…  But, regardless, they do keep fairly up-to-date records of what was on the drive.

To make matters even better, we have a procedure for backups which includes keeping them off-site.  Off-site storage ensures that we have backups in the event of something like a fire or a flood.  This usually means there’s a bit of time between a failure and a restore because someone has to go get those backups, but that’s ok, it’s all in the name of disaster recovery.

So here we are with a physical drive failure on our shared drive.  Well, that’s not so bad, you’d think, it’s a RAID array, right?  Well, no.  Apparently not.  Why don’t we use RAID arrays?  Not a clue, but it doesn’t much matter right now, all my work from that past year is inaccessible.  What am I supposed to do for today?

No big deal, I’ll work on some little projects that don’t need shared drive access, and they’ll fix the drive and restore our files.  Should only take a few hours, it’ll be finished by tomorrow.  Boy, was I wrong…

Tomorrow comes and goes, as does the next day, and the next.  Little details leak out as time goes on.  First we have a snafu with the wrong backup tapes being retrieved.  Easily fixed, they go get the correct ones.  Next, we receive reports of intermittent corruption of files, but it’s nothing to worry about, it’s only a few files here and there.  Of course, we still have no access to anything, so we can’t verify any of these reports.  Finally, they determine that the access permissions were corrupted and they need to fix them.  Once completed, we re-gain access to our files.

A full work week passes before we finally have drive access back.  Things should go back to normal now, we’ll just get on with our day-to-day business.  *click*  Hrm..  Can’t open the file, it’s corrupt.  Oh well, I’ll just have to re-write that one..  It’s ok though, the corruption was limited.  *click*  That’s interesting..  all the files in this directory are missing..  Maybe they forgot to restore that directory..  I’ll have to let them know…  *click*  Another corrupt file…  Man, my work is piling up…

Dozens of clicks later, the full reality hits me…  I have lost hundred of hours of work.  Poof, gone.  Maybe, just maybe, they can do something to restore it, but I don’t hold much hope…  How could something like this happen?  How could I just lose all of that work?  We had backups!  We stored them off-site!

So, let this be a lesson to you.  Backups are not the perfect solution.  I don’t know all the details, but I can guess what happened.  Tape backup is pretty reliable, I’ve used it myself for years.  I’ve since graduated to hard drive backup, but I still use tapes as a secondary backup solution.  There are problems with tape, though.  Tapes tend to stretch over time, ruining the tape and making them unreliable.  Granted, they do last a while, but it can be difficult to determine when a tape has gone bad.  Couple that with a lack of RAID on the server and you have a recipe for disaster.

In addition to all of this, I would be willing to bet that they did not test backups on a regular basis.  Random checks of data from backups is an integral part of the backup process.  Sure, it seems pointless now, but imagine how pointless it’ll be after hours of restoring files, you find that they’re all corrupt.  Random checks aren’t so bad when you think of it that way…

So I’ve lost a ton of data, and a ton of time.  Sometimes, life just sucks.  Moving forward, I’ll make my own personal backup of files I deem important, and I’ll check them on a regular basis too…

Ooh.. Bad day to be an IIS server….

Web-based exploits are pretty common nowadays.  It’s almost daily that we heard of sites being compromised one way or another.  Today, it’s IIS servers.  IIS is basically a web-server platform developed by Microsoft.  It runs on Windows-based servers and generally serves ASP, or Active Server Pages, dynamic content similar to that of PHP or Ruby.  There is some speculation that this is related to a recent security advisory from Microsoft, but this has not been confirmed.

Several popular blogs, including one on the Washington Post, have posted information describing the situation.  There is a bit of confusion, however, as to what exactly the attack it.  It appears that the IIS servers were infected by using the aforementioned vulnerability.  Other web servers are being infected using SQL injection attacks.  So it looks like there are several attack vectors being used to spread this particular beauty.

Many of the reports are using Google searches to estimate the number of infected systems.  Estimates put that figure at about 500,000, but take that figure with a grain of salt.  While there are a lot affected, using Google as the source of this particular metric is somewhat flawed.  Google reports the total number of links found referring to a particular search string, so there may be duplicated information.  It’s safe to say, however, that this is pretty widespread.

Regardless of the method of attack, and which server is infected, an unsuspecting visitor to the exploited site is exposed to a plethora of attacks.  The malware uses a number of exploits in popular software packages, such as AIM, RealPlayer, and iTunes, to gain access to the visitor’s computer.  Once the visitor is infected, the malware watched for username and password information, reporting that information back to a central server.  Both ISC and ShadowServer have excellent write-ups on both the server exploit as well as the end-user exploit.

Be careful out there, kids…

And now, a brief intermission

This is a technical blog, and as such, I have endeavored to resist posting personal, religious, and political views that do not directly relate to technology.  I feel that, up to this point, I’ve done a pretty good job with this.  But, occasionally, there is something that I really want to share that makes me re-assess this decision and weigh it against the intended purpose of this blog.

I started this blog on a whim, as a way of getting information out there.  A way of offering my own view on technology, and maybe even helping someone out.  In the end, however, it is my blog, and it’s a place I can post my own thoughts.  And so, I’ve decided to share this with you.  Feel free to skip over it, it’s not technical in nature.  But it did get me thinking, and it has made an impact on me.

 

On March 18th, Barack Hussein Obama, currently running for the democratic presidential nomination, made a speech in Philadelphia, PA.  In it, he addresses the issue of race in America, but not in a way many people have heard it addressed.  He addresses both sides of the issue.  And then he brings them together and explains, in simple terms, the reason race is still such an issue today.

Never have I ever heard this explained in such as way as to make me feel that someone else truly understands my own frustrations with the state of this country.  I’m not racist, and I never have been.  But like so many others, I still find myself scared when walking in a neighborhood not dominated by others of my own color.  I find myself frustrated when jobs, benefits, and more are given to people based solely on their race, and not on their qualifications.  I find myself outraged when simple issues are blown out of proportion, simple because they involve a minority or possibly offended someone.

In this speech, Barack pinpoints and explains these issues, and brings them into the open for everyone to see.  He explains not only how, and what, but why.  I think he truly understands, and truly feels that he can make a change for the better.  And that is why I plan on voting for him.

This speech is incredibly inspiring.  It was written by him, not by an aide, or a staff writer.  These words are his own, and he says them with conviction.  So, without further ado, Mr. Barack Obama.

Microsoft wants to infect your computer?!?

There’s an article over at New Scientist about a “new” technique Microsoft is looking at for delivering patches.  Researchers are looking into distributing patches through a network similar to that of a worm.  These ‘friendly’ worms would use advanced strategies to identify and ‘infect’ computers on a network, and then install the appropriate patches into that system.

On one hand, this looks like it may be a good idea.  In theory, it reduces load on update servers, and it may help to patch computers that would otherwise go un-patched.  Microsoft claims that this technique would spread patches faster and reduce overall network load.

Back in 2003, the now infamous Blaster worm was released.  Blaster took advantage of a buffer overflow in Microsoft’s implementation of RPC.  Once infected, the computer was set to perform a SYN flood attack against Microsoft’s update site, windowsupdate.com.

Shortly after the release of Blaster, a different sort of worm was released, Welchia.  Welchia, like Blaster, took advantage of the RPC bug.  Unlike blaster, however, Welchia attempted to patch the host computer with a series of Microsoft patches.  It would also attempt to remove the Blaster work, if it existed.  Finally, the worm removed itself after 120 days, or January 1, 2004.

Unfortunately, the overall effect of Welchia was negative.  It created a large amount of network traffic by spreading to other machines, and downloading the patches from Microsoft.

The Welchia worm is a good example of what can happen, even when the creator has good intentions.  So, will Microsoft’s attempts be more successful?  Can Microsoft build a bullet-proof worm-like mechanism for spreading patches?  And what about the legality aspect?

In order to spread patches this way, there needs to be some entry point into the remote computer system.  This means a server of some sort must be running on the remote computer.  Is this something we want every Windows machine on the planet running?  A single exploit puts us back into the same boat we’ve been in for a long time.  And Microsoft doesn’t have the best security track record.

Assuming for a moment, however, that Microsoft can develop some sort of secure server, how are the patches delivered?  Obviously a patch-worm is released, likely from Microsoft’s own servers, and spreads to other machines on the Internet.  But, many users have firewalls or NAT devices between themselves and the Internet.  Unless those devices are specifically configured to allow the traffic, the patch-worm will be stopped in it’s tracks.  Corporate firewalls would block this as well.  And what about the bandwidth required to download these patches?  Especially when we’re talking about big patches like service packs.

If the patch-worm somehow makes it to a remote computer, what validation is done to ensure it’s authenticity?  Certificates are useful, but they have been taken advantage of in the past.  If someone with malicious intent can hijack a valid session, there’s no telling what kind of damage can be done.

How will the user be notified about the patch?  Are we talking about auto-install?  Will warning boxes pop up?  What happens when the system needs to be rebooted?

And finally, what about the legal aspects of this?  Releasing worms on the Internet is illegal, and punishable with jail time.  But if that worm is “helpful”, then do the same rules apply?  Network traffic still increases, computer resources are used, and interruptions in service may occur as a result.

 

All I can say is this: This is *my* computer, keep your grubby mitts off it.

A Sweet Breeze

At Macworld this week, Steve Jobs announced a number of new products for Apple.  While most built on existing product lines, one stand out from the crowd as both unique and, quite possibly, daring.  Betting on the ubiquitous presence of wireless access, Jobs announced a new member of the MacBook family, the MacBook Air.

The MacBook Air is Apple’s entry into the so-called Ultra-Light notebook category.  Sporting a 1.6 or 1.8 Ghz Intel Core 2 Duo processor, 2 GB SDRAM, and 802.11n wireless access, this tiny notebook is nothing to scoff at.  Internal storage comes in two flavors, a 4800 RPM 80 GB hard drive, or a 64 GB Solid-State drive.

Conspicuously missing from the Air is an optical drive and an Ethernet jack, though external versions of these are available.  A notebook designed for a wireless world, the Air comes with special software to allow your desktop computer to become a file server, of sorts, so you can install cd and DVD based software over the air.  With the enhanced speed of 802.11n, even large installs should take a relatively short amount of time.

The Air has a few other innovations as well.  The keyboard is backlit, containing an ambient light sensor that automatically lights the keyboard in low-light conditions.  The touchpad now has multi-touch technology, allowing touchpad gestures to rotate, resize, etc.  A micro-DVI port, hidden behind a small hatch on the side, allows the user to connect to a number of different types of external displays ranging from DVI to VGA and even S-Video.  The 13.3″ widescreen display is backlit, reducing power consumption while providing brilliant graphics.  And finally, for the eco-conscious, the entire MacBook Air is built to be environmentally friendly.

But can Apple pull this off?  Will the MacBook Air become as popular as they believe it will?  Has the time come for such a wireless device?  Remember, Palm tried to get into this game with the Foleo.  The problem with the Foleo, of course, was that it was nothing more than a glorified phone accessory, depending heavily on the mobile phone for network access.  And while typing email on a full keyboard with a larger display was nice, there was no real “killer app” for the Foleo.

Critics of the MacBook air point to problems such as the sealed enclosure, or the lack of an Ethernet port.  Being completely sealed, users cannot replace the battery, or switch out to a larger hard drive.  In fact, though not announced, it appears that the Air will suffer the same battery replacement problems that the iPod does.  Is this necessarily a killer, though?  I don’t believe so.  In fact, I think it might be time for a fully wireless device such as this, and I’m eager to see where it leads.

Vista

It’s been a while since Microsoft release their newest OS, Vista, and yet the complaints just haven’t stopped.  I just ran across this humorous piece about “upgrading” to Windows XP and decided it was time to write a little bit about Vista.

I can’t say I’m an expert by any means as I’ve only had limited experience with Vista at this point.  What experience I did have, however, was quite annoying and really turned me away from the thought of installing it.  Overall, Vista has an interesting look.  It’s not that bad, in reality, though it does seem to be a bit of overkill in the eye candy department.  It feels like Microsoft tried to make everything shiny and attractive, but ended up with a shiny, gaudy look instead.

My first experience with Vista involved setting up a Vista machine for network access.  Since setting up networking involves changing system settings, I was logged in as an administrator.  I popped open the control panel to set up the network adapter and spent the next 15 minutes messing around with the settings, prompted time and again to allow the changes I was making.  It was a frustrating experience, to say the least.  Something that takes me less than a minute to accomplish on a Windows XP machine, or even on a Linux machine, takes significantly longer on a Vista machine.

I also noticed a number of pauses, quite noticeable, as I manipulated files.  This happened on more than one machine, making me think there’s something wrong with the file subsystem in Vista.  I’ve heard it explained as a DRM mechanism, checking for various DRM schemes in an attempt to enforce them.  Either way, it’s slow and takes forever to accomplish simple copy and paste tasks.

One of my more recent experiences was an attempt to get Vista to recognize a RAZR phone.  I never did get that working, even with Motorola’s Vista compatible software.  I tried installing, uninstalling, and re-installing the software several times, rebooting in between, enduring the stupid security dialogs all the while.  Vista seems to have recognized the phone, but would not allow the user to interact with it.

They say that first impressions are the most important and, up to this point, Vista has not made a good impression on me at all.  If and when I do move to Vista, it will be with me kicking and screaming the entire way…

Broken UMD? Here’s your cure…

When I first purchased my PSP, I picked up what I thought was a decent carrying case.  It was roughly the size of the PSP, but a tad thicker so it could hold 2-4 UMD games in addition to the PSP.  There was a cardboard divider to keep the UMDs away from the PSP screen, and straps to hold the PSP in.  All in all, it was a decent case.  Or, so I thought.

About a month or so after buying the case, I noticed that the clear plastic on one of my UMDs was cracked and pushing in towards the disc itself.  Over time, this got worse until the UMD wasn’t playable anymore.  I searched, in vain, for replacement cases.  The only suggestions I found were either to not break it in the first place, or to break open another UMD case you didn’t want, and super glue that case back together with the disc from the broken UMD in it.  Obviously, the first suggestion, complete with proclamations about the idiocy of such owners, was out of the question.  So, I tried the second suggestion.  I did get the case together, but the glue seeped out a little on the inside, creating a bump that the UMD would grate against.

Having failed to fix the UMD, I put it away, vowing to find a replacement case sometime in the future and to not break any other UMDs.  I went and purchased a new PSP Complete case from Slappa, as well as a few Score UMD storage cases.  There’s a nice comparison of the Score and Sony UMD cases on the official Playstation forum.  These two items kept both my PSP and my UMDs much safer, but over time, a few other UMDs started exhibiting signs of a cracked UMD shell.

Fast forward about two years and I come across this post on the PSP Fanboy site describing a new replacement UMD case.  This looked quite promising, so I went to the company’s site to check them out.  My first impression was that this was either a brand new company, or a scam site.  The website itself is pretty shoddy, mostly consisting of some poorly put together HTML and lots of Google ads.  However, they did have a video of the case itself and how it worked, so I trudged on.

Having seen the PayPal logo on the UMD ordering page, I decided to try them out.  I placed one UMD case into my on-line shopping cart and went to the checkout page.  The first thing I noticed on the checkout page was the lack of an option to use PayPal for payment.  I also noticed that the page was not encrypted with an SSL certificate.  I really had no desire to give this company my credit card information, especially with no SSL certificate in place, so I tried to proceed without entering it.  No dice.  I resorted to contacting the company via their online form explaining that while I did want a case, I couldn’t find the PayPal option.  Much to my surprise, they called me about 30 minutes later.

The gentlemen on the phone, whose name I forgot to write down, explained that the website was new and they knew there were some issues to work out.  He explained that the information entered on the checkout page was merely transmitted to PayPal for processing, but that I could use PayPal directly and just send them the money for the case, which they would then ship immediately.  I offered my concerns about the lack of an SSL certificate, which he promised to look into.  After we hung up, I headed over to PayPal to order.

The replacement cases are $3.99 each for US orders, and $4.99 for international orders.  This price includes shipping, so while it seems a little high, it’s actually not that bad.  I sent my $3.99 to the email address I obtained via my phone conversation and waited for the case to arrive.  Much to my surprise, I received my case in the mail a scant 4 days later.

The case was wrapped in a piece of light foam and placed inside of a standard white envelope.  Not the best packaging in the world, but MultiMedia Recovery (MMR) makes the claim that the cases are mostly indestructible.  True to their claim, the case was not cracked in any way and appeared to be in perfect shape.  I happily retrieved the UMD that was broken so many years ago and went to work placing it in the new case.

Honestly, the hardest part of the entire process is installing the frighteningly tiny screws into the new case.  I received three screws with my case, though only two are required.  I did have to go out and buy a jewelers screwdriver, though, but I should probably have one of those around the house anyway.  The screws secure the bottom portion of the UMD case, though I’m not sure they are really needed.  Even without them, the case fit together quite nicely and there was no danger of it coming apart later.  I suppose it’s possible that the case could be pulled apart when removing it from one of the UMD holders, but I don’t see that being a huge danger.  I installed the screws anyway and tried out the UMD.  It fit in the PSP with no problems, just like any of my other UMDs.  I fired up the PSP and the game loaded flawlessly.  Finally, I can finish playing Untold Legends.  Good thing I kept a backup of my save game…

 

All said and done, I think these replacement cases are a pretty good buy.  I would like to see discounts for bulk purchases, and perhaps better packaging, but overall, I am satisfied with my purchase and I will be purchasing more.  If you have UMDs that have broken in the past, I definitely recommend checking these out.  Hopefully MMR will address the problems with their website, but if not, the cases are available via david8950 on eBay.