Clampi – A banking Trojan – how to protect yourself?

As you know, in every situation police come after the crime. So does antivirus solutions for every malware. As underground business matures, so their way of evading detection of their tools (could be anything – worm, Trojan, etc) and started to use sophisticated mechanisms (encryption, virtualization) to go undetected.

To read more about Clampi (also called as Ligats, Ilomo, or Rscan) infects computers using drive-by-downloads and exploiting vulnerabilities in browsers. Please visit CNET.Com article http://is.gd/23i3x for detailed description and original detailed analysis of the malware from SecureWorks.Com by Joe Steward please visit http://is.gd/23kqb.

Here is the brief introduction of the Trojan – Clampi is a banking Torjan, a perfect tool for Identity Theft, and one of the largest professional thieving operations on the Internet. Clampi got all advanced technological tweaks to identify which AV is installed on the computer and evade detection. The Trojan is not available as Crimeware tool. But targeting world’s most big business. So far targeted about 4500 web sites across globe, out of which 1400 of them were identified in over 70 countries. Clampi is capable of spreading through Microsoft Networks without detection. The recent published theft amount was US$75,000 at Slack Auto Parts (see news coverage on Banking fraud using money-mules
http://is.gd/23olr). There could be many unpublished huge sums by Clampi!

Note: Money-mule is a legitimate bank account holder like you and I. The actual thief transfers stolen money into our accounts, then ask us to write a check to the name they specify, usually to a different country.

Primary method of spreading: drive by download, then through pen drives. With its worm capabilities, it spreads across networks by stealing administrator credentials.

I would like to suggest three possible solutions to circumvent Clampi (also most other malware) from stealing your banking credentials. While this does not remove (see below for removal tools) Clampi from your computer, but might help you for a work around. Please note that solutions 2 and 3 are demos in my IT Security Awareness Program, I am happy to present here for your reference. I feel solution 3 is most effective for any one.

1. Use a separate PC, an extra effort on – your pocket, real estate at your office / home office and many more.

   How to do it? – You are on your own my dear J.

    

2. Use Sandboxie (or virtualize your web browser) to browse, this may not be the best solution, as the Trojan can spread through other means, but this can prevent your computer from the changes made by your browser by undoing those changes after completing the browsing session. The similar option is available in IE8 as InPrivate browsing (after opening new tab, you will see a hyper link “Open an InPrivate Browsing window”). I would like to see similar option in all the browsers in the future.

   How to do it? – By using Sandboxie please read SANS Institute white paper on Virtually Secure Browser – http://is.gd/23lzP.

    

3. Use VM Player and a free UNIX variant virtual machine (VM) appliance to do your financial transactions, best way to protect from all Microsoft Windows based malware attacks. This will also give you an idea on using new OS. Make sure that you meet the minimum system requirements. Otherwise your system will run very slowly.

   How to do it? You need not be a UNIX guru just to your UNIX VM and open the browser to go online. There are many free VM appliances available. You need to do two things for this:

   1. Download free VM Player http://www.vmware.com/products/player/

   2. Download one of Linux (or UNIX) variant appliances for free. I am giving you the link to Ubuntu 9.04. (I use BackTrack 4 at which contains all security related tools). Ubuntu is good for UNIX beginners, which almost Windows like interface and lots of free tools. http://www.vmware.com/appliances/directory/va/147323/download

Sorry I am unable to give you complete instructions in this post. But here is the link from Ubuntu Help site https://help.ubuntu.com/community/VMware/Player on the installation of the same, but for Ubuntu 8.04, not 9.04. Please feel free to play and learn.

You can contact me if you need any specific instructions on how to implement any on the above solutions, just leave a comment below, I will get back to you.

Again sorry for the long gap in posting to this blog. I was busy on some other project. Form now I promise to have regular posts for your online security education. You can also Tweet me at Http://Twitter.Com/ITSKratu. Thanks for visiting my blog.

How to save IT support costs while improving organizational efficiency and reduce support staff work load!

In the first part I will discuss the business scenario, and in the second part I will discuss the technical solution implemented and finally in the conclusion I will explain what we achieved after implementing new solutions. I was motivated to write this article after I received a call from one of my previous colleagues. She told me they are so happy and really productive with the solution that I when I was with them and how they gained competitive advantage. It seems that they also advised several of their customers to implement the same solution over a period of time. I am really happy to hear that and I would like to share the same with you.

Part 1 The business scenario!

Any business manager is concerned about support cost, both IT related and non IT related. The minimum the support cost is better it looks in the balance sheet. The biggest challenge facing by almost all the IT business managers or owners is how to reduce support cost, while improving efficiency of employees, reduce work load. There are volumes of books, and thousands of articles were written on this topic. And importantly there are big corporate companies with products that they claim to reduce support cost, if you invest few hundred thousand dollars to millions of dollars, depending on the size of your organization. Despite all these most do not know how to lower support costs in the best possible manner, with minimal or no investment. Surprised! Yes with minimal or no investment! Read the post, you will understand.

I would like to take an actual business case, for which I proposed and implemented a solution to explain this further. For confidential and NDA reasons I cannot revel the company and employees names. The company was our client, to whom we provide IT infrastructure solutions and I was assigned as senior Trusted IT Security solutions manager in the mid 2006. When we were discussing on how to reduce IT support costs with one of the business managers in that mid size company, who was a no-techie, said like this. “That it is impossible! Possible only if you can invest few hundred thousand dollars if not millions, which can be recovered over a period of few years”.

Then I asked him what kind of support issues your IT support staff had to deal every day? I would summarize his answer in the following points.

• To manage 500 computers in the company at multiple locations they had
  • 10 full time support staff
  • 4 part time support staff (students from a local university)
  • Some agreements with local service providers for remote locations
  • A manager to manage all of them
  • The above staff is apart from system, database and network administrator(s)
• The work is repeating every day involving the following activities (or facing problems)
  • Changing mostly desktop configuration settings due to unauthorized applications, malware or users changing settings unknowingly
  • Malware removing (spyware, adware, virus, malware)
  • Re-installing existing applications
  • In some cases they have to reimage the Windows OS
  • It is becoming increasingly difficult to manage remote locations due to limited resources
  • Sometimes support staff needed to work overtime to fix the problems when trouble shooting takes lot of time
  • Due to troubleshooting activity the user is not able to work (loss of productivity)
  • Computers are becoming slow after few weeks or months of re-imaging
• Some users do not want to re-image OS due to application and OS settings
• Experiencing delays in deliverables, for example due to computer problem, sometimes they are not able to prepare reports on time or type documents on time.

He also said that due to overheads and delay in closing a call, we were not able to spend more money and time on security awareness and other employee training or benefits. I was surprised that this manager was security conscious. Later I found that few months ago a security breach by a simple mistake of a manager caused them to lose a big project to a competitor.

Note: In my prior assignment I had experience in providing cost saving solutions, mostly relating to support and IT security related. I was largely successful in reducing IT support cost by over 50%, create security awareness among employees and improve overall organization efficiency.

After a week of first meeting with the business manager, with little home work about the company operations, I took an appointment with the same manager to propose a solution. My previous experience in similar solution was very helpful in this for this fast response. In that meeting I asked him the following.

Would you be thrilled to reduce half of support staff (except dedicated network support team), reduce their work load, at the same time improve overall organizational operational efficiency, reduce client project delivery times and many more? He was really puzzled and looked at me with disbelief, but still very much interested to listen to my proposal. Then I had shown him the following points un-hiding one by one from a printed paper.

• Improve IT support staff efficiency and reduce their workload
• Reduce IT support staff to almost half
• Reduce number of calls to support department by less than half
• Reduce duration of down time on each desktop when a problem arises
• Improve over all employee efficiency, thus making them happy and improving productivity
• End users should not able to install application that are not officially allowed
• Even malware would not be a major problem (can this really possible?)
• Reduce electricity bill (Green IT)
• Create IT security awareness among your employees with part of the costs saved (this is my key interest, as I conduct security awareness program)
• Even improve remote locations support and over all employee efficiency and satisfaction
• Most importantly balance security and productivity
• All the above without investing a million dollars, which you need to recover over a period of time
• Finally make your CEO happy, and let your balance sheet get more attention at the end of the year

He was really curious to learn more about what I had to say next. With disbelief and hesitation he wanted to test my solution on few desktops. Since I already know the solution, I asked him to give me 10 desktops from a department where they had most problems without giving him much technical details. Looking at my confidence, he agreed for my request even though I did not explain him my technical solution completely.

Part 2: Implemented technical solution!

Tools / techniques used for testing

Microsoft Steady State (free, formerly Microsoft Shared Computer Toolkit), Faronics Deep Freeze and Faronics Anti Executable, Microsoft Power Save Management options (free) and Faronics Power Save.

Initially we choose to implement Microsoft solution on 5 desktops and Faronics solution on 5 desktops. We choose to upgrade RAM to minimum of 1 GB and in some to 2 GB due to heavy resource access.

Advantages of Reboot to restore solution: Microsoft Steady State and Faronics Deep Freeze are the two products which will restore the desktop to the original, no matter what you do on the computer after a simple reboot. Deleting files, changing settings, malware installation, or any other change, just a reboot will simply revert back all the changes made in this session. Since these tools also manage disk defragment, which will help Windows to run like first day.

Advantages of Anti Executable: Microsoft Steady State and Faronics Anti Executable both provide the option to allow only certain applications (application white listing, black listing or grey listing). This will allow only white listed applications and warn the user about grey listed applications and will not allow any other application that is not approved.

Advantages of Green IT (power save options): We used Microsoft power save options and Faronics Power Save to turn off monitors after 10 minutes of inactivity and turn off computer after 1 hour of inactivity.

These solutions were mostly implemented in education sector (shared access), mainly Microsoft and Faronics promoted these solutions only for education and public access computers. I was really surprised why they did not promote in corporate environment? These are really good products to implement in any kind of setup (including at your home) with proper planning.

Final Solution Implemented: After three weeks of evaluation the manager realized that he had no support call from those 10 computers. At this time we did not have a way of testing how much power we saved during the three weeks. In the mean while I gathered some more information on how best we can implement this solution and proposed a complete solution. Finally they had decided to implement Faronics products for various other reasons apart from the following:

1. Better centralized management of Deep Freeze and Power Save which allows Windows updates
2. Product support from vendor (obviously Microsoft does not have support options for free product)
3. Faronics can run on both 32 bit 64 bit versions of Windows , but Steady state is compatible only with 32 bit version of Windows
4. Faronics Enterprise versions have better centralized management options compared to Microsoft solutions
5. Faronics Power Save got more control and audit and report options than Microsoft Power Management, which can also be configure remotely

Products Implemented: Faronics Deep Freeze Enterprise, Faronics Anti Executable Enterprise and Microsoft Power Options configured centrally.

After preparing the final report and coming up with detailed implementation policy based on user roles and buying some additional hard ware (RAM upgrade to a minimum of 1 GB for required computers and some new computers for better performance).

Initially we had decided to implement the solution in the entire organization in phased manner with 100 computers each time, one month apart. After completing the first phase implementation they saw tremendous improvement in employee efficiency, reduced support calls. After one month of testing, we had decided to implement the new policy on all computers as soon as possible. Over the next 45 days we have completed the implementation instead of 5 months as planned initially. Each and every desktop had to be prepared (mostly reimage), some hard disks had be portioned to store files locally. Each and every desktop was also preconfigured to access a network drive.

Conclusion: The following results were observed!

1. Total number of support calls had gone down by 80% to less than 10 per day from over 60 per day.
2. Support personal had more time with reduced work load, so they were assigned different tasks, concentrate on creating awareness or transferred to different departments and part time employees were no more required
3. They had decided to reduce the no of support staff to 5 from 14 (including 4 part time personal)
4. The managers saw efficiency in over employee performance and reduced delivery time of tasks
5. Power bill was reduced by nearly 20% (at the same time implemented moving sensors to turn on and off lights, ACs and created awareness among employees about the same)
6. The management had decided to upgrade some more computers for the end users, invested in LCD display panels, IT Security awareness programs for all users (I was part of this) and other related programs

References:

• Microsoft Steady State Download
• Microsoft Steady State technical FAQ
• Faronics content library for white papers, case studies and more
• Faronics Power Save Advanced Calculator, a good page to understand on how much you might save

New way of living and new way of cheating

Happy Day!

Yesterday I received a spam email from my grandfather. I just wanted to browse the same and see what it contains. Then I thought that I should this as an article as in my blog to share with you. This is another example of spam is not always spam.

I really can not verify the truth in the two stories that I am going to publish, but worth reading them and changing how we think, act and live in our every day with the latest gadgets that we own very proudly. I sure that the gadget saved many lives in many situation, helped many in different ways, at the same time the opposite is also true. So read the following first.

Subject of the email: New Theft ideas

New Electronic Technology and theft

First story: GPS

A couple of weeks ago a friend told me that someone she knew had their car broken into while they were at a football  match. Their car was parked on the green which was adjacent to the football stadium and specially allotted to football fans. Things stolen from the car included a garage door remote control, some money and a GPS which had been prominently mounted on the dashboard.
 
When the victims got home, they found that their house had been ransacked and just about everything worth anything had been stolen. 

The thieves had used the GPS to guide them to the house. They then used the garage remote control to open the garage door and gain entry to the house. The thieves knew the owners were at the football game, they knew what time the game was scheduled to finish and so they knew how much time they had to clean up the house. It would appear that they had brought a truck to empty the house of its contents.

2. MOBILE PHONE
 
This lady has now changed her habit of how she lists her names on her mobile phone after her handbag was stolen. Her handbag, which contained her cell phone, credit card, wallet…etc… was stolen.
 
20 minutes later when she called her hubby, from a  pay phone telling him what had happened, hubby says ‘I received your text asking about our Pin number and I’ve replied a little while ago.’
 
When they rushed down to the bank, the bank staff told them all the money was already withdrawn. The thief had actually used the stolen cell phone to text ‘hubby’ in the contact  list and got hold of the pin number. Within 20 minutes he had withdrawn all the money from their bank account.
 
 Moral of the lesson:

Do not disclose the relationship between you and the people in your contact list. Avoid using names like Home, Honey, Hubby, Sweetheart, Dad, Mom, etc…. And very importantly, when sensitive info is being asked through texts – CONFIRM by calling back.

 Also, when you’re being text by friends or family to meet them somewhere, be sure to call back to confirm that the message came from them. If you don’t reach them, be very careful about going places to meet ‘family and friends’ who text you.

Conclusion:

I really feel that most of us would never think about the possible ways of getting cheated. Because it is not our way of living or that is not want we do. But for those who cheat or rob, it is their way of living and their duty is to find new ways and their responsibility is to escape.

So never write something at any place other than your own brain that is easy to for others to understand and follow you. Use code names for your personal information. It is our duty to protect our valuables and our responsibility to be safe, neither our local police nor our government’s.

Have Fun!

Downadup / Conficker – Confused!

Happy Day!

Over the past few weeks IT security industry and professionals learnt a lot about Downadup worm. The worm spread to several millions of computers. Still no one identified if this worm has done anything significant that effects the individual privacy or steal personal information, except its ‘intelligent spread’. Everyone is waiting to see what the author’s intension is? The only way to know is when this worm does something really interesting thing, which could be dangerous.

As the news and information about this worm is wide spread, most of the security professionals found a way to monitor its behavior, and most importantly the prevention and detection methods were also found and implemented. In this situation it is most unlikely that the author wants to take advantage of this worm in the known methods.

One of the possible methods the author can take advantage is by taking advantage of its peer-to-peer communication capability. If the same happens it would be very difficult to detect and prevent the worms spread. Some Antimalware vendors speculated the prediction of spread by F-secure and downplayed they theory.

In my opinion the best way to be safe is to be aware of basic security principles through education and practicing them.

Here are more links about the worm for your information.

First I would like to provide you the link with the removal / disinfection instructions, and 20 plus things you can do to ‘be happy, be secure’.

Symantec – Peer to Peer Payload distribution!

Symantec – Geographic location spread. This information is not matching with F-Secure statistics. This difference is understandable if they both have presence in different countries with varying customer base. But they claim that they found that the IP addresses they discovered when the Downadup worm contacted their domains (which they registered from the list generated by the worm). Unless both the company executives sit together and come to a conclusion and then give us a proper explanation, the rest of would be confused.

This two part article in German has very good information on this worm. The link in German language and the link to English translation page with Google.

Confusing further, PC-Mag.Com said that the worm spread numbers are dubbed in their title.

In the wake of this worm, I feel that there should be some regulatory body which coordinates with all these companies and publishes appropriate information to the general public. As of now there is no such body. If any of you know, please feel free to comment below.

In one of my next posts, I would write an article on how to effectively combat malicious programs, please RSS feed this blog.

Have fun!

Worm: Downadup or Conficker is getting bigger day by day!

Happy Day!

In my previous post “What are the consequences if you are not ‘Be Secure, Be Happy’?” I took Downadup as an example to explain. Now the worm is getting bigger day by day. As of 23^rd Jan 2009 the total unique IP addresses that F-secure detected has increased to over 1 million from 350,000 a week ago. Again Panda Security said that there could be well over 50 million infected Windows computers (that is 6% of all Windows computers) in 83 countries, and that could be even more. The security industry is facing big challenge in disinfecting this worm. So it is every ones responsibility to stay secure. So be security aware to ‘be secure, be happy’! You may way to get started with What is IT security? to become security conscious.

To learn more about this worm and removal instructions you can visit my blog post here for related information. For your quick your reference here are the related links:

F-Secure – How big this worm is?

F-Secure – Detailing the geographic location wise break up information – Where is Downadup? According to the list China, Russia, Brazil and India are in first four. So if you are living in any of those countries you may have to pay special attention to stay away from this worm.

F-Secure’s Removal tool: If you are infected by the worm, you cannot reach any of the anti-malware web sites. So F-Secure provided different links to download their removal tool. Related blog article here, for removal tool ftp site link 1 and link 2.

Microsoft: KB article 962007 for more description, removal tool MSRT (Malicious Software Removal Tool) and removal instructions.

If you are not able to go to the vendors’ web sites for removal instructions, you may want to download the removal tool, and go here for removal instructions.

You can choose to follow either Microsoft’s or F-Secures instructions, both companies instructions are not required. If you have any further questions or need any help please feel free to contact me directly Kratu@G.Ho.st or Hari Emani at Gmail dot com.

Have fun!

Mind Map – 20 plus things you can do to ‘Be Secure, Be Happy’!

Happy Day!

Here is the mind map that I created using VisualMind for your reference. You can display it in the notice board or at your desk for regular reference. Here is the main post 20 plus things you can do to ‘Be Secure, Be Happy’!

Click on the following Mind Map to see a large image. Please post a comment if you find any more useful info that fits in this Mind Map.

Have Fun!

20 plus things you can do to ‘Be Secure, Be Happy’!

Note: These are only guidelines. There may be other settings or policies that you may need to pay attention in order to stay secure. There are number of ways you can accomplish a solution. These solutions I use most at my home computers or I recommend to my friends or at my office. I compiled these for your quick reference. Please feel free to comment if you have an alternate solution to these. Please remember to backup your data before you install any application or change any setting either using Windows registry or any other policy editor. Please be cautious on whatever you do and completely take responsible for your actions.

These days data security is becoming an important part of every one’s life. Based on my experience I compiled 20 plus things you can do to ‘Be Secure, Be Happy’. I have tested all of them at my home lab and others computers. You can follow the steps in any order you like, there is no restriction.

I derived my inspiration to write this article after learning from Secunia’s report that 98% of home computers are not secure. So please send this post to all the people you know.

I can write a lot about each and every option that I mentioned here, but for the purpose of this article I will briefly describe about each option. If I need to write a separate article, then I will provide a link here. Most importantly to use or implement some of the things you need to learn and understand the complications involved in every solution. For that reason I provided as many references as appropriate. Please do your homework before you try to implement any of these or comment below with your question so that I can reply.

Here is the mind map listing the following for your quick reference. Go to the page and save it for further reference. You may way to display in your notice board or at home or office desk.

1. Scan your file with multiple free malware engines at once.
2. Scan your computer with multiple malware engines, one by one.

   Please read my blog entry Malware Scans – Multiple Engines, Online Scanners for more information.

3. Use good passwords which are easy to remember and hard to guess.

   To make good password, take a sentence for example ‘I was born in 1970′, remove all the spaces, or replace all the spaces with pipeline (|) making the password i|was|born|in|1970. Passwords with 14 or more characters are impossible to break. Here is a good link with good suggestions on password policy. I really liked this, very simple and informative. Please remember never write your passwords on post it notes and stick on your monitor or at some visible place. Use the same principle for all other sensitive information.

4. Change the default settings of all your equipment, mostly user names and password.

   Any hacker or script kiddy with little knowledge can get you if you do not change the default settings on your computers, routers, switches or smart phones. To have better knowledge just go to Google and type ‘default passwords list’, you will be surprised to see how many sites will come up. If you go to any of the default password list pages you will know most commonly used words either for login names or passwords are admin, tech, HTTP, multi, and password. I found several devises have no password at all. Vendors do this to allow their devices work ‘out of the box’ without any additional setup as Plug and Play. This is true even for most expensive routers or switches, or hardware based firewalls and even databases. With little knowledge any one can very easily access your devices to further exploit if these settings are left as is. Please refer to your product vendor document on how to change default password.

   Most importantly you should disable Guest account and change (or set) Administrator password or even better change Administrator name in your Windows OS.

5. Anti Executable – Software Restriction Policy (SRP) which allows your computer to run a white list of applications that are considered to be safe to run. This is a great option to protect your computer from most malware. You have users who use either intentionally or unintentionally install applications, or even a malware happened to install other programs. You can protect your desktops with SRP. In Windows 7 Microsoft improved this and calling as AppLocker, I need to test this feature in the beta version.
   1. For a very good description of SRP visit Microsoft’s TechNet page, also contains information on how to implement in XP.
   2. You can follow the Microsoft’s guide for XP, and
   3. You can follow the Microsoft’s guides for Vista.

   Apart from Microsoft solutions there are also third party applications. Fraonics Anti Executable is one of them. Here are the links for product’s main page and key features comparison between Standard and Enterprise Editions, and the review. I have a feeling that Faronics Anti Executable got more functionality and ease of use. I would appreciate any comments on this.

6. Disable AutoRuns.

   Sometimes disabling auto runs will definitely help to reduce the spread of malware. The recent worm Downadup which effected nearly 10 million computers worldwide, in a span of two to three weeks, uses auto runs feature to spread through removable devices. Please read my other post What are the consequences if you are not “Be Secure, Be Happy”? for more information on this worm and other important information related to security.

   How to disable Auto Runs? Most of the times while you insert a thumb drive or CD/DVD, you can hold Shift key, to disable auto run. If you want to permanently disable on all drives edit the registry key NoDriveTypeAutoRun under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
   and set to x0ff in both XP and Vista. It is that simple.
   

   You may also need to remove the following entry for each user separately to remove any cashed information for the removable devices, network folders that you might have connected earlier, if the above solution is not properly working. Please remember you need to reboot your computer in order for the settings to take effect.

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
   

   I would recommend if you share your computer with many or if it is a public access computer then disable USB ports and removable drives.

   The following solution to disable autoruns is recommended by many compared to Microsoft’s above solution. I found this at US Cert site and at the actual author Nick Brown’s blog Memory Stick Worms. The comments contains very good information, a good read for techies. The following is the extract from the site.

   To effectively disable Autoruns in Microsoft Windows, import the following registry value:

   REGEDIT4
   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
   @=”@SYS:DoesNotExist”
   

   Note: If you see a smiley after @SYS in the above line, please replace the text with the text from the following image or follow the same instructions at US CERT web site. The Word Press is converting the text after : into emotions. I know how to disable for the entire blog, but not to a particular post. I feel emotions are important to express ourselves and I want to keep using them as needed and also for my commentators. I appreciate your cooperation in this regard. I will update the post once I find how to disable emotions for a particular post.
   

   
   

   To import this value, perform the following steps:

   1. Copy the above text between HKEY… and …..DoesNotExist, including quotes
   2. Paste the text into Windows Notepad
   3. Save the file as autorun.reg
   4. Navigate to the file location
   5. Double-click the file to import it into the Windows registry
7. Install decent antimalware.

   AV-Comparitives.Org and Virus Bulletin are the sites you can depend on to choose a solution for your need. Once you installed your malware product, update malware definitions every day. Some vendors have the option to update every hours or even minutes. Let me assure one thing. No antimalware is perfect. If you look at the history of the vendors who responded first to provide a solution for a malware outbreak, there is no consistency. I would say which one to use is a personal preference and follow alternate solutions mentioned in #1 and #2 in this list. Most importantly install ThreatFire a free Zero-Day threat detection based on malware behavior pattern. This will help your existing AV tool to increase the detection rates. Visit their site to learn more.

   HiJackfree is a free tool for advanced users who wants to scan their computer for any kind of malware – virus, spyware, worm, Trojan, etc, with no live protection. A 2 MB file is good tool to be in your sec tools box.

8. Install a decent two-way firewall.

   Microsoft has a built-in firewall that most home users are not aware of. It blocks only inbound traffic. There is no satisfactory explanation from Microsoft on this implementation. Hopefully Windows 7 will be improved (I installed Windows 7 beta but not reviewed much). Again most malware vendors provide a firewall bundled, so you may not have to look separately for a different firewall. Here is PC Magazines firewall comparison.

9. Use a good (and free) anti spyware application.

   There are several tools on the net claiming that they scan your PC for spyware, but the programs are ’spyware’ so be aware of the trick that the bad guys play. Before you use any tool, please check their credibility by looking for references or use Web of Trust for page ratings. The well known antispyware tools are Spybot Search & Destroy and Ad-Ware from LavaSoft. Here is PC World Magazine review of spyware in which Spybot S&D, also my favorite one, is better rated than the other.

10. Update your Windows OS with Windows automatic update.

    Turn automatic updates on your Windows OS and perform regular updates so that your vulnerability level is very low. If you are a corporate user, then your system administrator would use SMS (System Management server) to update your PC. Alternatively you can go to Microsoft’s update page using your Internet Explorer (this page does not support any other browser) to perform interactive update. This page will update all installed Microsoft’s products apart from your OS.

11. Download and install only trusted applications

    How to identify trusted applications? The best way is to look for any awards that the product received from an independent third party or look for reviews or Google or use Web of Trust for page ratings. Never, ever put yourself at risk by installing a tool from un-trusted sources. If you want to test some ting, isolate a PC and install on that test PC.

12. Update all your applications regularly – Vulnerability Scanning

    This part is really hard. It is really difficult to keep track of all installed applications and update the patch, especially if that application does not have auto update algorithm implemented. In this case Secunia PSI (Personal Software Inspector) and F-Secure’s Heath Check online scanner become handy tools for any one. Secunisa PSI, a tiny application checks all the well known (again well known) installed applications and compares the patch level against their database. F-Secure Health Check is an online scanner and will also check for any known vulnerabilities. They will give you a report of installed version of the applications on your computer and the latest version available on the vendor’s site and with appropriate remedial solutions. You may want to run them once in two weeks to check your computer. Again do not use any tool that you may come across. Check for their credibility by visiting reference pages or by Googling or StopBadware.org

13. Avoid free Wi-Fi or Hotspot access points and turn of Wi-Fi on your mobile when not in use.

    Avoid Free or Public Wi-Fi access unless you have done most of these things to immunize your computer. If someone can get hold your smart phones Wi-Fi signal, they can easily get your data. So turn of the options, in some phones you should also turn off WLAN

14. Secure your Wireless router at home or office.

    Update I: Drew in his comment pointed that WPA2 in AES mode is secure, not WEP (Wireless Equivalent Protocol) and mentioned that MAC address can be spoofed. He is correct, thanks Drew for your corrections.

    Use WPA2 in AES mode and set your router to accept connections only from known MAC or Physical address of your network card. MAC address is a 12 character alpha numeric number assigned to your network card by the vendor. Please refer to your user internet modem/router manual or vendors’ web on how to do this. Due to the large number of models I cannot provide how to guide here. But if you have any specific question please feel free to email me or comment below. And even most important, change your default user name and password as mentioned in #4.

    To find the MAC address at a command prompt type ipconfig /all. Here is example of my MAC address. If you have more than one (wireless card and RJ45 card) then it will list all of them.

    Physical Address. . . . . . . . . : 00-1B-38-14-1B-08

15. Do not share your sensitive information with strangers or publish at social networking sites.

    Very important! Please read my another post what is Sensitive Information? for better understanding.

16. Implement reboot to restore tool to protect from unwanted changes to your computer.

    Reboot to restore tools for personal computers exist for quite long time, but not many people know about this. In the recent years this is becoming most popular with Schools and Internet cafes and some call centers, but not with large corporations. I have a gut feeling with careful planning and implementing in the corporate environment this tool could be very useful. I would write more about this in a separate article at a later point of time. These tools help you to save the hassle from reimaging or restoring the computer after corruption. Once you setup any of these tools and then if you install any other application or make any changes to your computer including deletion of most important files, the tool will revert back the computer to its original state just like new after a simple reboot, including the changes made by a virus, spyware or any malware.

    Two most popular tools are a free tool from Microsoft is Steady State and a third party tool is Faronics Deep Freeze. There is some initial work is required to setup any of these and some initial planning too. So I will give you details in a separate post Reboot to Restore. In the meanwhile you can visit Microsoft SteadyState and Faronics DeepFreeze pages on how to install and for further instructions. Please read ‘Before you install Reboot to Restore’ tool.

17. When on the net habituate STOP, THINK and CLICK procedure.

    This is most difficult to habituate, but easy if you install a web page rating tool link Web of Trust. WOT will provide you feed back about the site you are visiting. This tool got a very good rating 4.5/5 at CNET.Com. Most recent versions of “Total PC Protection” solutions from several vendors also incorporated a way to inform the user about the rating of the web page being visited and even block the page completely.

    File Advisor service by Bit9. With a simple upload this service will give you every detail about the file including original name, size, creation date and much more. A good service to use!

    F-secure claims that their Exploit Shied tool will protect you from web based malicious exploits and stops malware at the first point of infection, which protects your computer. This is in beta and you can test this by downloading.

18. Encrypt your computers’ HD, not just your important data files.

    Why encrypt your entire hard drive? Now-a-days portable computers are highly targeted. In case if a laptop is stolen, then data will not be accessible. Now which encryption is best? Software based or Hardware based? There are pros and cons in every solution. Please read the article Whole disk vs. file based encryption. I would choose Hardware based. The main reason is that on a long run, you need not face support issues, just install and know that the data is encrypted and accessible only through a key card. The best solution in the market is SecureD with complies with FIPS 140-2 Level 3 (Federal Information Processing Standards). For Windows XP and Vista Home edition you can use Encrypted File System (EFS) option is available to encrypt at various levels. Here is a simple step by step guide for your reference. In certain editions of Vista you can use BitLocker and visit Microsoft page for EFS implementation guide. TrueCrypt is a third party free open source disk encryption solution, which is trusted by many hackers in the community. It is important to remember that implementing encryption may cause performance degradation.

19. Use encryption to store your data on removable devices or use encrypted removal devices.

    TrueCrypt is one free solution you can use to store or backup your sensitive data apart from Windows EFS (as explained above). But remember you need to remember the key or password to be able to use the data at a later point of time. IronKey manufactures removable devices with ‘Self-destruct sequences using advanced “Flash-Trash” technology’ to erase data if someone is trying to access the data without proper key. Ironkey’s products are one of the best products available.

20. Use encryption to communicate your sensitive data via email and for VoIP

    There are several solutions to send data securely. A web based free solution is Hushmail. Every Email client Outlook 2003 and 2007, Mozilla Thunderbird, Novell Evolution have a built in option to send encrypted emails. Click on the respective links. Both sender and receiver need to have some knowledge on how to send and receive encrypted emails. For web based email clients, some support is there with GPG/ PGP protocols. You may want to Google for the same.

    For your VoIP calls Zfone is available from the creator of PGP Phil Zimmerman. Update II: A recent study concluded that many employees undermine laptop security mainly due to implementation of encryption. Please read it here, a good read for non-IT security personal.

21. Shred everything beyond recoverable state.

    How many times you saw someone shredding very important document before discarding? You need to use a very good document and CD/DVD shredder before you through them in garbage. Most importantly, you may never want to send out your old hard drives. A single hard drive needs to be formatted 7 times if you do not want anyone to recover the data. Even better, destroy it if you feel that it contains very sensitive information. Update III: There are other tools and methods to secure erase your hard drive. I found a good article for the same.

22. Finally shut down your computer when not in use, even for an hour.

    It is always good idea to shut down your computer when you leave your work or go out at your home after using for a while. Never leave your Internet connection unless you really need to. I see some of my friends’ login in to their IMs and leave it as is, even weekends and midnight.

23. Disable unnecessary services in Windows XP and Vista

    This may not be related to security, but I felt that if you choose to implement several solutions in the list, they may slow down your PC. I hope this helps to speed up your PC a bit more. You can also use Autoruns tool from Microsoft SysInternals to disable some programs from loading. Be careful and backup your important data before you make any changes from this section. To access windows services type services.msc at run command prompt (Windows Key + R or Start-> Run) and press enter key.
    

    Windows Vista: There are over 130 services in Windows Vista. The biggest question is which services can be disabled? I thought that I would write my BIG BOOK on that. Fortunately someone else had done that in a better way, so I would simply redirect you to TweakHound.Com page. Need more info, for the list of all vista services and their descriptions to SpeedyVista.Com (have better description in one page) and for step by step instructions and the list of services you can disable to VistaWired.Com.

    Here is the list of services that you can disable for your quick reference with direct link on why you can disable the service to VistaWired.Com page.

    Windows XP: There are over 110 services in XP by default all of them are not started. Some of the services are started by the depending program at the time of execution, then stops automatically. I would like you to direct you to BlackViper.Com site for list of all XP services. Please visit this page for the list of 25 services that you can safely disable listed at Freelist.Org post.

A word about encryption! Do not go any ware without data encryption in any of your devices if you do not want anyone to see your data.

Finally a caution, if you choose to implement SteadyState, Antivirus, Encryption and Anti-Executable you will experience significance performance degrade. So you need to play and decide what you actually need.

I hope you gained some valuable insight about your own security.

References:

1. Memory Stick Worms.
2. The Dangers of Autoruns.
3. Microsoft’s KB article 953252 Auto-Run registry entry in detail for both XP and Vista.
4. ‘Internet Commonsense’ by Bill Mullin.
5. FIPS 140-2 at WikiPedia.Org.
6. What is Hardware Based Encryption?
7. Whole disk vs. file based encryption.
8. The Risk of Full Disk Encryption – Solved by a Cell Phone
9. To Encrypt or not to encrypt?
10. Misconceptions about encryption
11. Windows Vista Bitlocker

Have Fun!

Malware Scans – Multiple Engines, Online Scanners

Happy Day!

Caution: Before you download any program or run any online scan, please take two minutes to verify the legitimacy and credibility of the tool. How to do this? Look for third party certifications like CNET.Com (Download.Com) or SoftPedia.Com’s certificate, etc. This will give you little more confidence about the program you are going to use. If the site gives you a reference to the awards that the tool received, then please go that page and read. The effort and time is well worth. I recommend you to do the same even to the sites listed in this page. Most importantly backup your important data before you do anything.

As you might have understood that there is no ONE solution that fits all problems. I want to show you a way so that you can be extra cautious if necessary. For example you received a file that you feel is important, and you are suspicious about the file content. You ran virus scan with your existing tool, did not show any thing. You are still suspicious, what now? In this case what are the options? This is the right page you are in. You have two options.

Option one – scan single file with multiple malware scan engines: You can choose to upload the file to one of the following sites and run the scan against various malware engines at the same time for free. So here are some of the links.

First of all why do you need to scan with multiple engines? The best answer is there is no single technology that fits single solution. Second not all engines detect all malware. If one engine misses, then the other can detect it. That is why one antimalware engine is not sufficient to protect your computer. See the result below. I uploaded a legitimate file (Remote desktop access tool Tight VNC) that I know is good. But still some vendors gave the result ‘false positive’. In this case I should use my commonsense to use the file or not. Out of 38 malware scan engines, 4 engines raised ‘false positive’ from ViruaTotal.Com. And I am glad that two of them said ‘not a virus, remote admin tool’. Please note that two vendors have the same name for the same malware, confusing the common user further.

The following screen shot is from Jotti.Org web site for the same file, again raising 4 ‘false positives’ out of 22 malware scan engines. Here also I am glad that two of them said ‘not a virus, remote admin tool’

Here are the links for the free Multiple Antimalware (antivirus) scanners. There are many other sites exist, but I found these two are good.

Note: The following sites have file size limit that they accept to scan.

• Jotti.Org
• VirusTotal.Com
• Virus.Org
• VirScan.Org
• VirusChief.Com
• Filterbit.Com

Option two – online scanning your computer: You think that you have some virus in your computer, you scanned your computer with you existing software, found something or nothing. Or you have a big exe file or archive file that you can not upload for scanning. In that case would not it be nice to have scanned with several antimalware tools on your computer one by one? For example TrendMicro would discover some virus, Kaspersky Labs would find some more, finally you can get all the benefits for free again.

Free Online Scanners, most of them require IE recent version and some do not clean the infected files.

• Trend Micro House Call. This site has free secure email tool.
• Kaspersky Lab
• Norton (Symantec) – It is a downloadable tool where you can download the scanner and scans for free every week. Try this, very good.
• E-Set
• McAfee
• Zone Labs
• GFI Trojan Scanner. This site contains many other useful tools.
  
• Prevx CSI Free scan. You can upload your log file to their site for further analysis. Their response is very fast and good, my personal experience. Visit their site for more description.
• Norman SandBox Information site. Norman Sandbox site differs from the above as this would analyze the contents of your uploaded file for malware. Very good site to learn more about a malware that is bothering you.

Other related resources:

• Spyware links, really lots of links. You may not need all of them.
• Real time current virus alerts (from many vendors, very useful)
• Self- help Malware removal instructions.
• Antivirus tools comparison sites
  • AV-Comparatives.Org
  • Virus Bulletin
• HijackThis is a tool from TrendMicro, which scans several important and critical areas (mostly accessed by malware programs) of your computer for malware and create a log file for further analysis. You can use this log to detect any issues with your computer. The best way to solve your problem is to upload your log file to HijackThis.De site for further analysis. Please remember that you will have to take further action to secure your PC unlike malware tools. HijackThis is only analysis tool, not a removal tool. There are several forums that you can take help to further analyze your log file.
• Most importantly install ThreatFire a free Zero-Day threat detection based on malware behavior pattern. This will help your existing AV tool to increase the detection rates. Visit their site to learn more.
• HiJackfree is a free tool for advanced users who wants to scan their computer for any kind of malware – virus, spyware, worm, Trojan, etc, with no live protection. A 2 MB file is good tool to be in your sec tools box.
• A very good web site MDGX.Com with several links on Malware and its removal tools. Also check their other pages for very interesting information.
• I really did not understand the intension of this page. This web page contains so many links on antimalware tools even I took some time to understand the intension of the page. Please visit the site if you have courage and want to get something out of this page.

Additional References:

• List of 40 Malware free scan engines
• Dancho Danchev article Multiple Malware Scans

Have fun!

What are the consequences if you are not “Be Secure, Be Happy”?

Happy Day!

Note: This is the first in the series ‘What are the Consequences if you are not “Be Secure, Be Happy”?‘ I will keep on posting several articles over a period of time as I find more stories, some of them would be real life stories.

You read or learnt a lot about IT Security in general. But did you ever heard what will happen if you ignore the “Basics of Security”. I would like to explain this with an example that happened in the first half of Jan 2009 and continues to happen.

Microsoft released a patch MS08-067 on Oct 23^rd 2008 to mitigate the vulnerability which allows executing code remotely if an effected computer receives specially crafted instructions in certain Windows OSs. If you had turned automatic updates on your computer, and if you performed the same, then you are safe from this worm.

What if I did not stay up to date? The worm, Worm:W32/Downadup.AL, the simple name Downadup by F-Secure, that appeared in Nov 2008, reappeared in the first half of Jan 2009 with more advanced functionality, as described below.

Update on Jan 27^th 2009:

Over the past few weeks IT security industry and professionals learnt a lot about Downadup worm. The worm spread to several millions of computers. Still no one identified if this worm has done anything significant that effects the individual privacy or stealing personal information, except its ‘intelligent spread’. Everyone is waiting to see what the author’s intension is? The only way to know is when this worm does something really interesting thing, which could be dangerous.

As the news and information about this worm is wide spread, most of the security professionals found a way to monitor its behavior, and most importantly the prevention and detection methods were also found and implemented. In this situation it is most unlikely that the author wants to take advantage of this worm in the known methods.

One of the possible methods the author can take advantage is by taking advantage of its peer-to-peer communication capability. If the same happens it would be very difficult to detect and prevent the worms spread.

In my opinion the best way to be safe is to be aware of basic security principles through education and practicing them.

End of update on Jan 27^th 2009!

What should I do if I am already effected by Downadup or Win32/Conficker.B?

• F-Secure’s Downadup page, very good description of the worm, removal instructions and more and some aliases.
  
• Microsoft KB article with detailed description and removal instructions for Worm:Win32/Conficker.B http://support.microsoft.com/kb/962007.
  

Note: Every vendor in the market has a way of naming a virus. The following are the names from various vendors. This is only a partial list to give you as an example. At the end of the name .A or .B denotes the next version or another variant of the same virus found earlier. So if you are searching for more information on the virus on the Internet, you need to keep in mind this information, and search with different names.

F-Secure	: Net-Worm.Win32.Kido or Worm:W32/Downadup.AL
Microsoft	: Worm:Win32/Conficker or Worm:Win32/Conficker.B
Kaspersky Lab	: Net-Worm.Win32.Kido.fo
Symantec	: W32/Conficker.worm.gen or W32.Downadup.B
Sophos	: Mal/Conficker or Mal/Conficker-A
McAfee	: W32/Conficker.worm.gen.a
Ikarus	: Net-Worm.Win32.Kido
BitDefender	: Win32.Worm.Downadup

Most importantly the worm can spread through removable devices (also can copy itself to the same) if auto run is not disabled. And changes most important security related settings (registry key settings, auto-run settings, access rights to the user, etc) in the computer, so that the worm can stay inside the computer undetected. The worm is also capable of avoiding antivirus detection by working with rarely used APIs. It is also disabling windows update and certain network traffic optimizing features to ease its spreading further and give access to its author to use your computer as zombie as part of botnet.

Also blocks access to certain web sites based on string filter algorithm so that you cannot download any antimalware or patch to apply. For example if you are visiting F-Secure site, it will close the browser or will not allow you reach the web site.

Finally the worm is programmed to automatically generate certain domain names based on the time obtained from ask.com, google.com, w3.com, etc. The worm generate more than 250 domain names every day, and contacts them either to update itself or download new code for further execution. This makes it impossible for the Anti-malware program to detect or even to establish a behavior pattern. So far the estimation is that the worm infected more than 3.5 Million PCs effected across the globe and the Dark Tech world is ready for another botnet using the zombie computers.

What should I have done to avoid this?

1. Turn on Automatic updates, and updated your Windows OS regularly.
2. Turn off Auto runs
3. Use a decent antivirus program and scan your computer regularly. Visit AV Comparitives.Org for a comparison of antimalware tools.
4. Be careful not to receive any programs from unknown sources, especially P2P networks.

Conclusion: Even if one computer in the entire network is left un-patched, the entire organization can be effected. And if all the zombies’ are used as botnet, the impact could be devastating. Due to one person’s ignorance others are also being effected in the network, putting the entire organization at risk. This means anything can happen. Your sensitive information can be compromised exposing you to further risk. Look at the following extract from F-Secure’s blog ‘How big is Downadup?. Read the following extract from F-Secure’s blog to know better.

A very large part of that traffic is coming from corporate networks, through firewalls, proxies, and NAT routers. Meaning that one unique IP address that we see could very well be 2,000 infected workstations in real life.

I would recommend every organization to conduct Security Awareness programs once every year.

Hope this helps you to Be Secure, Be Happy!

Further reference:

• My other blog post Malware Scans – Multiple Engines, Online Scanners for malware scanning and removal options.
• BitDefender’s description at MalwareCiity.Com and further reference and their Removal tool.
• ThreatExpert.Com for worm name aliases.
  
• Book: The art of War by Scott A. Watson. A very good book for all managers, especially for security managers and business owners in the current situation we are living. There is a good reason to refer this book here. This book many good strategies that we all need to know to progress in our daily life.

Have fun!

How to implement IT security?

A company may have purchased the best security technologies that money can buy, trained their people so well that they lock up all their secrets before going home at night, and hired building guards from the best security firm in the business.

That company is still totally vulnerable.

Individuals may follow every best-security practice recommended by the experts, slavishly install every recommended security product, and be thoroughly vigilant about proper system configuration and applying security patches.

Those individuals are still completely vulnerable.

Extract from Kevin Mitnick’s “The Art of Deception” book.

The single weakest link in the entire security of an organization or individual is the Human Factor. IT Security is not about technology, it is the process implemented through awareness. You will not know when an enemy strikes; you will know only when the enemy strikes.

How to implement IT security? This question is really hard to answer for any one or for any organization. The main reason there is no single solution that fits every one. Perhaps there are multiple solutions that fit a single solution. The best way to implement IT Security is to assess own need and requirement, then after careful consideration consider a standard frame work that best suits your need. For example for PCI DSS (Processing Card Industry Data Security Standards for credit card and related organizations, HIPAA (Health Insurance Portability and Accountability Act) is for health care industry and for telecommunications there is a standard within the ISO 27000 series. Some of them are standards and some of them are acts. An act is mandatory to follow by the respective organization based on local law and a standard is merely a guide line to be followed. At any given point of time an organization may need to implement more than one act to comply with the local regulations.

All these frame works (or acts) only tell you “How one can implement IT security based on certain guidelines, and how you can come up with certain management policies for your own IT security?” Not which technology or tool(s) that you need to use for a specific scenario. Let us take a very basic need – antimalware – these guidelines or frame work will tell you that what kind of standards the antimalware program should meet, but does not mention about a specific vendor or an application to choose from a list.

One need to be aware of the present day technology, risks, advantages and limitations associated with each technology and methodology. So to conclude one needs to carefully study the requirements of any organization before trying to implement a particular security solution.

What an individual needs to consider to ‘Be secure, Be Happy’?

I can suggest a few guidelines:

• Never give out any information that may identify you or your family or your back ground to someone that you do not know
• Discuss about the related concerns with your family and friends. Tell them to be alert of any suspicious behavior or unusual activity
• Try to memorize your credit card pins and internet login passwords, never write them and place them any ware, except in a safe place
• If you are filling up a form at any place, and if they ask you for your DOB, or SSN or any ID no, ask questions. Why do you need this info? How do you store these forms? If you feel uncomfortable about the safety of those records, then do not share the information.

Some guidelines on how to use your computer and how to be when you are on online:

• Always use encryption to store and transfer your important information
• Always update all the applications to the latest path level with automatic updates
• Use good antivirus, antispyware and firewall and stay up to date on virus definitions
• Apart from regular scanning of for malware of your computer, I would recommend you to use online free scanners once in a week or two.
• If you are suspicious of a file, then you can use multiple antivirus scan engines by uploading the same file to a site
• Never open attachments if you do not know from whom you got
• Never follow a web site link if you received from unknown source
• Stay away from Peer to Peer file sharing, unless you trust them
• Do not enter any personal information unless you double check the site address of your financial institution. Now-a-days most browsers tell you the authenticity of the site you are visiting.
• If someone is asking your personal or financial information either over email or over phone, never reveal. Your financial institute would never ask you such information over the phone.
• Always disconnect your computer from internet if you are not using Internet, and shutdown if you are not using to ‘Be Green’

Please remember that these are only guidelines, you still need to consider so many other factors based on your situation and your life style.

Most importantly be vigilant about what you do all the time until it becomes your way of life. You need to be careful sometimes even with the one you know the most. There is lot more one needs to learn, if you feel that something fits here, please feel free to comment or email me Kratu@G.Ho.St.

Apart from the above I would like to give you some of the highlights from ISO 27000 Complaint framework that any organization need to consider in implementing IT security.

• Risk Analysis – objectives, roles, responsibilities, program requirements, and practices program elements
• Staff Member Roles – policies, responsibilities and practices
• Physical Security  – area classifications, access controls, and access authority
• Facility Design, Construction and Operational Considerations – requirements for both central and remote access points
• Media and Documentation – requirements and responsibilities
• Data and Software Security – definitions, classification, rights, access control, INTERNET, INTRANET, logging, audit trails, compliance, and violation reporting and follow-up
• Network Security – vulnerabilities, exploitation techniques, resource protection, responsibilities, encryption, and contingency planning
• Internet and Information Technology contingency Planning – responsibilities and documentation requirements
• Travel and Off-Site Meetings - specifics of what to do and not do to maximize security
• Insurance – objectives, responsibilities and requirements
• Outsourced Services – responsibilities for both the enterprise and the service providers
• Waiver Procedures – process to waive security guidelines and policies,
• Incident Reporting Procedures – process to follow when security violations occur
• Access Control Guidelines – responsibilities and how to issue and manage badges passwords
  

 

Have Fun!

PS: At present I am working on other related posts. Once I am done I will update this post with appropriate links for solutions.