2 Things Everyone Needs to Know about the WPS Vulnerability

I Promise Not to Own your WifiYou may have heard recently that there is a vulnerability affecting many wireless access points. It has to do with Wi-Fi Protected Setup (WPS) which is supposed to make it easier to configure devices to use your wireless network. The problem is the WPS system is vulnerable to a brute force attack that will allow a malicious attempt within range of your wireless signal to access and change settings on your device. Once the foot is in the door there are many other things that can be done, especially if you have un-protected devices on your network.

The two things you should know if you own or are responsible for any wireless access points are:

  1. There is no practical universal solution to the problem.
  2. You may have to use the hacking tools themselves to be 100% certain you are not vulnerable.

If you feel you have anything someone might want to steal, the smartest thing might be to just disconnect the wireless access point or turn it off. Then live without it until the manufacturer has clear information on your make and model of wireless device. Of course if your wireless access point is also your Internet Router this could be problematic.

There are more questions than answers right now and while you can’t tell with certainty if you are not vulnerable a list is being compiled of devices that have been confirmed to be vulnerable. You can access the WPS Vulnerability Testing Document to find devices that have been confirmed.

Known and potential solutions

Solutions to this issue will be updated here as they become available

Belkin (Does not note if this fully disables WPS!)

Netgear (Home Routers)

Additional Resources

Vulnerability Note VU#723755 (US-Cert)

Special thanks to @Shonali for sharing the Bart Simpson Chalkboard Generator.

This article originally appeared on my business blog on 1/6/2012.

Finding Airline Flights with Google Flight Search [Video]

Google Flight SearchGoogle has so many properties, most of us will never try them all. I stumbled onto an interesting tool last week that you may find useful for researching airline flights. The Google Flight Search application lets you do what most fare search sites let you do and a couple of things they don’t:

  • See at a glance based on where you are now what it would cost to fly to different locations.
  • Check alternative source and destination routes.
  • Filter down by pricing and flight time.
Like many Google tools Flight Search has that simple look and feel you’ve become familiar with over time. Check out the video for more insight and a demonstration of the features.

Don’t see the video or browser doesn’t support Flash? Watch the video here.

Expand your content sharing with Print Friendly and PDF

As bloggers we’re always looking for ways to make our content more friendly, encourage conversation and encouraging distribution of the content to amplify our voice. I recall seeing the Print Friendly plugin for the first time over at Waxing Unlyrical. I thought it was interesting but didn’t connect the dots until yesterday that is.

Why some of your readers will love this plugin

Think for a moment about your less tech savvy readers, the ones who may not even have a Twitter account or won’t bother to click the LinkedIn share because they rarely log in. Or think about the friends and connections of your tech savvy readers that won’t want content delivered anywhere but the old tried and true – Email. This is where the true power of Print Friendly lies. In this video I demonstrate how the plugin works and describe in more detail why I think it is great for the web 1.0/Email crowd.

Video not showing up? Try this direct link.

For Infosec Geeks: Geographic Routing Controls

The average PC user does not need access to the entire Internet. The more they have access to the more potential sources of security issues. Consider that many high profile crime syndicates operate out of the APNIC, what if the average user could just turn off that entire address space from his computer with a click of the mouse? Imagine being able to open up a window and just select the Regional Internet Registry zones that you have a need to access from the selections below:

Regional Internet Registry Zones

Regional Internet Registry zones - Image Credit Arin.net

In an “advance mode” you could choose to drill down farther and pick other locales within the zones. For example perhaps you need access to only Japan, Australia and India but want to limit exposure to hosts in China and other ACPNIC countries. Lazy users could just subscribe to “recommended” settings for their region based on levels of security desired.

Why bother?

There are several very good reasons why this approach can contribute to making end users more secure but more importantly make it more difficult for internet criminals and countries that harbor them. This idea actually came to me as a result of writing an article about the RSA hack that resulted in a re-issue of all of their secure-ID products. I learned that the host that the Poison Ivy malware had contacted was a known source in other attacks.

Why was RSA allowing traffic to communicate with a known malicious host?

The host in the RSA hack was located in APNIC, again a zone that the average user does not need access to and probably would not even miss. In this example the attack would have failed and if the criminal was determined they would have to find another way creating more risk for them (of detection) and having to work harder at it. Potentially becoming discouraged and finding something more lucrative to do with their time (with a little luck something legal). As to the governments that allow these sites to function within their borders, they will drive themselves into further isolation. There are few nations in the world that would not be bothered by significant volumes of users bypassing sites in their country.

Corporate and Government Applications

This technology could quite easily be adapted to corporate use, centrally managed and even include a dynamic black list of emerging dangerous addresses. Say for example that a particularly nasty virus was spreading through the internet; most malicious apps have to phone home somewhere (to get instructions, etc). Push that out to the blacklist for millions of users and you have millions of users that even if they do get infected the command and control is effectively cut off instantly.

What would happen when you try to access a site in the blocked zone?

We know malicious programs attempting to access blocked sites would fail but what about when you attempt to access something you know to be legitimate? In these cases the connection would fail if it was within the blocked zone. A screen could easily be added for a web browser “this site falls within your blocked zone” with conceivably the option to allow adding it to the safe list.

It’s not perfect, how can we make it better?

I realize this solution is not perfect but I think the idea is a solid one. It introduces some new leverage to the information security problem. Ok Infosec pros, what would you do to make this an even better solution?

What expecting Mothers and Entrepreneurs have in common

Have you observed a expecting woman’s behavior closely? It’s fascinating to watch expecting moms organizing, cleaning, arranging and planning for their babies (father’s get involved, too of course!). Many refer to this as nesting behavior, did you know that entrepreneurs do the same thing? A couple of weeks ago I was meeting with a friend of mine who is CEO of a successful company. We chatted for an hour and at the end of the hour I walked away realizing:

  1. My friend is very good at giving critical commentary in a constructive way.
  2. I was feeling really good about who I am, what I have accomplished and what I am capable of.
  3. The bar had been raised.

That was a great example of Leadership, a great leader brings out the best in others.

It’s awesome to see people succeed, to be passionate and to be inspired. Though the road to that success is not a ten lane freeway at midnight or a short flight with clear skies and no turbulence. It is usually a winding road with periods of dense traffic, accidents and other disruptions or setbacks. One way to reduce these disruptions is to occasionally take a step back and carefully evaluate, clean up your house, and plan a route that avoids obvious peril. Take inspiration from a nesting mother, there is nothing more important than what she is doing and let her attention to detail inspire you in your preparations.

My Entrepreneurial Nesting

I started my entrepreneurial nesting around my home office and garage after the inspiration unleashed by my friends leadership had surfaced. In my garage I methodically but purposefully separated equipment to keep, sell and e-waste. You could say not unlike a soon to be mother would be preparing the babies room.

Have I mentioned I love the symbolism between garages and startups?

I have also felt quite un-settled, knowing that my blissfull ignorance about my professional future has been shattered. Then I posted this on Facebook:

Facebook Update

Within an hour or so of that wall post I had started writing this blog post, recognizing the genesis of that un-settled feeling.

Hindsight evidence

My Drobo that I use for my personal bulk storage has dropped from 2.4TB of data to well under 1TB of data in less than 1 week. Instead of buying a crib, baby toys and pastel colored paint I bought 4 2TB hard drives to consolidate some of the archives in the data vault (tip – low cost serial ata hard drives + a usb to sata adapter is the cheapest and fastest archive media system money can buy).

Clean, Organize, Clean, Organize, Archive, Plan, Brainstorm, Clean, Archive… Repeat…

I have zealously defended my inbox, not allowing more than a dozen or so messages left that require action at the end of each day. I frugally re-purposed my old laptop to act as a local virtual server. My office environment is calm, clean and quiet. I’ve re-organized 2 of my desk drawers and have amassed a large pile of paper and other documents to shred. Our trash can and recycle bin have remained full. I’ve enjoyed using my evenings, free time on weekends and even part of my birthday to do these things. The excitement is building….

I am at the precipice of where any hint of complacency is getting properly obliterated by un-bridled entrepreneurial spirit.

I’ve run my IT business Managed Solutions since January of 1997. During those years I’ve observed huge swings in some of my clients fortunes. Many of them have made it, some have not and others have struggled for long periods of time. I’ve watched a lot of people succeed and I feel very fortunate to have been able to do what I’ve been doing for so long. I’ve been a student of success and failures both of my own doing and those of others. I’ve operated instinctively and with little direction from any mentors or leaders and that is the biggest thing that has changed.

The Leadership examples that I have experienced the last couple of years have made me realize that in the future that leadership is the one that is going to matter the most.

I promise not to ask any of you to buy me pickles and peanut butter or put any A1 sauce on my Macaroni and Cheese….

Stay tuned for more.. :)

Introducing Internet Radio Mashup

Since November of 2009 I’ve been maintaining an internet radio talk show on Blog Talk Radio. Since I don’t have a commercial incentive/requirement and do it largely because I enjoy it, it’s provided me with complete flexibility of subject matter, frequency and format. A few trends have evolved over time, so many of my shows fall under these general guidelines:

  1. Most involve 2-3 “panelists”
  2. Technology, Science, Non-Profits and Social Media are my main subject matter topics.
  3. Most episodes are just about 1 hour.

Why panels?

I do enjoy one on one discussions but the chemistry that emerges from groups is way more powerful. Panels that I’ve organized have discussed everything from what it is like to participate on TV’s Survivor Reality Series to Measurement, a Life Saving Gov 2.0 Application, Branding, and even a PRapalooza. With good panel chemistry the discussions can be hilariously funny and really shorten the perceived distance between the panelists and listeners. I’ve also been fortunate to have some excellent repeat guests perhaps most notably Yau-Man Chan, Kathrina Rashid, and the dynamic trio of Shonali Burke, Danny Brown and Gini Dietrich.

A new concept is born!

Recently I had an idea to bring together a mashup of interesting panelists to not necessarily tackle any topic in particular but to discuss issues of the day. The first panel of this kind is scheduled for Wednesday August 31st at 3PM Eastern time when guests Adriel Hampton (Nationbuilder), Melanie Burkie (SonRise Equestrian Foundation) and Rachael Seda (Host of Two JMU Alum Podcast) join me for Internet Radio Mashup Episode #1. Planning to listen, check out this post about getting the most out of Blog Talk Radio as a listener. Check out the official logo:

Internet Radio Mashup Logo

Want to join me?

I encourage my friends and readers to inquire about participation on my podcast. Just use my contact form and let me know that you’re interested.

Curating Tweets on Amplify and using Twitter to get off pesky Email lists.

What do you use Twitter for? It seems a great use is to get opted out of Email lists where the opt out procedure leaves a lot to be desired (or doesn’t work).

Also a great use of Amplify is curating tweets right from Twitter.com or Hootsuite. The Amplify clipping tool is absolutely an essential part of my toolkit. Have you ever used it?

hackmanj 8:37am via HootSuite

Hi @WinZipComputing I’ve been trying to opt out of your Emails but they keep coming. Suggestions? #uce #spam

WinZipComputing 8:52am via TweetDeck

@hackmanj Happens sometimes that you might be on more than one email list. Write in to help@winzip.com, direct it to Bill. I’ll see to it

hackmanj 9:22am via HootSuite

@WinZipComputing Email sent, please confirm you receive it. Thanks Bill.

WinZipComputing 9:23am via TweetDeck

@hackmanj Got it. Now I need to see how many different people need to be involved to get you off whatever lists you are on. I will reply.

hackmanj 9:40am via HootSuite

@WinZipComputing do you agree it ought not be so complicated? A simple one click should be all we have to do, no?

How I am working to find focus

FocusI am sharing this in the hopes that you will find it helpful if you are finding it difficult to manage your time in this 24/7/365 connected world.

How am I working to find focus? Perhaps will start with a little bit of background. In addition to my freelance work with Web 2.0,  Blogging, WordPress Dev and Social Media I am also the founder and owner of Managed Solutions. As a result I’ve had to wear quite a few hats since January of 1997. One of my priorities recently has to become more focused and effective with my time, largely out of necessity (sad eyes looking at the gaps in my blog postings!). In an effort to help gain focus I started keeping track of every minute of my work day, not just my client billable time. That process provided me with the inspiration to write this post which for the record took EXACTLY 61 minutes start to finish.

Since I spend a good part of my time doing IT work it is hard to really schedule my time effectively. That said I have a general flow to my work schedule right now, this is the general framework that I work with by day of the week:

Mondays – Sales and Marketing

Ok so in theory I am performing sales and marketing efforts on this day. The truth is I often get a lot of customer calls on Monday mornings. Many a Monday becomes a response fest – a good chunk of my living comes from providing IT services to my clients.

Tuesdays – Field Days

I schedule foreseeable appointments on Tuesdays most of the time. I have a Rotary meeting at 7AM in the morning so I just keep on going from there.

Wednesdays – Work Days

Work as in billable project work, I schedule foreseeable projects for Wednesdays. Objective is to be logging time on projects all day every Wednesday. Usually the early in the week fire drills of Monday have concluded and I am able to focus on finishing longer term work.

Thursday – Flex Day

Thursday is pretty much a catch up day; ideally it is a carry-over of Wednesday.

Friday – Finance and Flex Day

I catch up on finance and accounting on Friday’s. I also tend to schedule meetings on Friday’s because it is lighter on the IT side of things most of the time. I also have time on my Friday agenda for Social Media posting for the next week. This can quickly fall in the priority list if it’s been a busy week or customers have urgent needs.

After Hours and Weekends

I tend to do a lot of remote tasks that require me to work after hours so I plan for and execute these tasks on week nights or over the weekend. I do my best to balance the time I spend with time spent with family. I make sure I limit the discretionary time for non-family and work items to avoid allowing my work or family to suffer.

A little exercise

As I mentioned I started to track everything I do, every minute of the day to identify my true activities and to help remove bottlenecks. I’ve not been doing this long but I discovered a couple of really important facts:

  • I work for free a lot more than I realized.
  • Accounting and Finance are very time consuming.
  • Responding to Social Media and Email especially can take up a lot of my time.
  • I usually take 30-45 minutes for lunch/family time during a typical 8-5 work day (even though I work at home)

Making adjustments

Now I am starting to make adjustments. I am already a serial un-subscriber and a master Email filter writer both help me cut down on Email time, but I am also trying to keep my responses short and to the point. I am also ignoring and deleting a lot more non-essential Emails. One thing that I find that really helps is to always consider my long term objectives in everything I am doing. If for example I am getting notices about technologies that really don’t fit then I don’t even file them for later reading, I just delete them. I think keeping long term goals in mind is a great way to reduce the burden that all these tools (E-Mail, Twitter, Facebook, etc) can help to create. I always make time for things that are important to me, that is one thing that won’t change, much to the contrary.

What’s Next?

I will continue to refine my process. I am also going to make sure that I am being compensated for more of my work or at the very least keep track of the freebies and make sure the customer knows about them. I can also use this as a basis to fine tune my compensation and estimating. I am also narrowing my long term focus and planning to be more specialized. I have in my business these last 14+ years always responded to what the market (and more importantly my customers) were needing. I can still do that but sometimes it might be by recommending a trusted third party to handle certain aspects of their needs. These relationships can be great sources of new business. I’ve had several of my partners send leads to me for more of my core business.

Do you have any similar practices? I would enjoy hearing about them.

Photo credit ihatatho

Tools for Social Media 10 Minute Presentation

I was asked to give some tips in ten minutes to my Rotary Club on how to use Social Media more effectively. The average member might access Facebook casually and has limited time for Social Media involvement. After looking at their situation I came up with this presentation and delivered it this morning. It is a quick read but the suggestions I made could easily be applied to any business or cause.

7 Reasons you should still use Hyperalerts for Facebook Pages

Facebook recently added alerts and other changes to the Pages Interface in fact I have a video and post about it Facebook makes big changes to Pages Interface. This will be handy for people who don’t want to bother setting up a Hyperalert but there are 7 reasons you should still use Hyperalerts for Facebook Page notifications (5-7 were added on 2/13, read on to see why):

  1. You can use Hyper Alerts with ANY page (not just those you admin)
  2. You can sign up from ANY Email address (even one that forwards to multiple recipients)
  3. You can receive your own content (imagine if you have multiple admins)
  4. You can control WHEN you receive the updates.
  5. The quality of the hyper alert emails is excellent, complete with comments so you get the context.
  6. Hyper Alerts provides a dashboard to manage your alerts (and add more, etc)
  7. Hyper Alerts provides a record of all alerts in your Email folders (Mari Smith mentioned this in her post)

So don’t go and delete your Hyper Alerts just yet, it’s still the best tool for the job. If you want to learn more about Hyper Alerts check out my recent post Monitor any Facebook Page for Posts, Comments and Content.

Here is a sample of what the Facebook option looks like:

Facebook Email notification

Here are the superior Hyper Alerts options:

Hyper Alerts Add Alert User Interface

So what do you think, will you still use Hyperalerts for Facebook Pages or is Facebook alerts enough for you?

Update 2/11/2011: a Skype chat with Are Sundnes of Hyper Interaktive

I wrote the above post on 2/10/2011 and scheduled it for 2/14 before receiving an Email from Hyper Alerts detailing why they feel Hyper Alerts is still a better option. After receiving the Email I did a minor investigation to see if I could find someone at the company to chat with. I went to their site and it was in Norwegian, but I did recognize “Kontakt” so I clicked through and found an Email address. After sending an Email I got a Skype connection from Are (pronounced Ari) Sundnes. Within minutes (and being the wee hours of the morning his time) Are agreed to chat with me about Hyperalerts.

hyper interaktiv

More about Hyper Interaktiv developers of Hyper Alerts

Are Sundnes is a concept designer and programmer for Hyper Interaktiv. His company does creative advertising and development. They have 24 employees and as a small company many of them multi-task. Are is just one of those people, you see while being a digital artist by trade he actually programmed the Hyper Alerts system mostly by himself in response to needs they some of their clients had. It would be just our luck as I am very impressed with what they’ve done and I suspect there will be more to come in the future. Are would not give me any specifics but he did tell me they have lots of plans for Hyper Alerts and that they are in the process of prioritizing them. I also learned that the proliferation of their Hyper Alerts service has been completely organic. They have done zero marketing in fact due to the strong response they are working on a English language version of their website as you are reading this.