Technology

PDF spam rides again - vulnerability found

Emerald Technology, Inc. — Wed, 24 Oct 2007 20:12:11 GMT

Yes, it happened. Hackers finally found an exploit in PDF files. Remember a while back when I said it would happen? They will look for an exploit and then hit them again. Well, that started today. In the past 24 hours Adobe has released a security fix (which almost no one has), and we have seen over 12,000 new PDF spam mails! That's right, 12,000 PDF spams in less than 24 hours after the exploit was announced by Adobe.

Read the Attack of the PDFs blog entry over at ZDNet.

Symantec and a few others have already updated their virus definitions. But how many IT departments regularly go to the Adobe site and patch? I doubt very many do. I know several companies still running Acrobat version 6 or later because it works for their needs, and the upgrade prices are very high for very little improvement to a typical users "build a PDF" workflow.

So, expect a lot of new PDF spam emails coming your way again... sigh.

Microsoft researchers follow the Search Engine Spam money...

Emerald Technology, Inc. — Tue, 20 Mar 2007 20:17:18 GMT

Take a look at Ryan Naraine's blog at CNet. Microsoft just published some interesting stats on Search Engine spam. This is one of my personal pet peeves. There are some very interesting results.

These same sites are being hit almost constantly for actual email spam as well. They send you to one of these URL's through an email, it auto-clicks on an ad for a product for you. You look like a unique hit to the search engine and they pay up for an ad click to these fraudsters.

Emerald Technology, Inc. acquires VistaDB

Emerald Technology, Inc. — Thu, 15 Mar 2007 03:12:48 GMT

San Diego, Calif. - March 14th, 2007 - Lorant Corporation (d.b.a. Vista Software) is pleased to announce today that Dr. Jason Short and his new entity VistaDB Software, Inc. (Owned by Emerald Technology, Inc.) has signed an agreement today to acquire the VistaDB product line from Vista Software.

“I am very excited to announce that Dr. Short will be taking over VistaDB,” stated Anthony Carrabino, President/CEO, Vista Software. “Jason and his team have a wide range of technical knowledge and organizational skills that will bring VistaDB to new levels as the world’s best managed and embedded SQL database engine for .NET, Compact Framework and Mono. VistaDB customers, our development team and the VistaDB product line will benefit greatly from this acquisition.”

As a long time power user of VistaDB, Dr. Short has used VistaDB, .NET and Mono to develop a commercial cross-platform spam filtering product called Emerald Spam Shield. Emerald’s state-of-the-art spam filtering engine scales to hundreds of concurrent users in real-time and makes extreme use of VistaDB.

VistaDB customers have been benefiting from Jason’s .NET and VistaDB expertise for years on the company’s support forums as the number one contributor. Dr. Short and co-worker Mike McDonald’s in-depth knowledge of VistaDB and .NET is expected to bring a great deal of value to VistaDB customers, stated Carrabino.

“The deep integration of VistaDB into Emerald Spam Shield has given us priceless first hand experience with VistaDB,” stated Dr. Short. “We know exactly what is needed in the product and we finally have the ability to make direct changes. I am very excited to take over the VistaDB product line and look forward to working with the team to make VistaDB better than ever before.”

Dr. Short and his team are expert C# developers that specialize in managed code optimization. According to Carrabino, he expects that Jason and Mike will make immediate contributions to help VistaDB performance and scalability. Other improvements to the VistaDB release and testing process are already taking place, so VistaDB customers can expect to benefit very soon from this acquisition. New and improved VistaDB documentation and technical articles are already in the works as well.

The VistaDB development team that includes Mr. Mike Orlov and Mr. Evgeniy Bhatov have been working closely with Jason for weeks and will be joining VistaDB Software, Inc. Anthony Carrabino, President/CEO of Vista Software has been working closely with the new management team and expects all operations to be completely moved over by April 1, 2007.

PPC advertising is dead because of search engines

Emerald Technology, Inc. — Tue, 13 Mar 2007 19:55:47 GMT

Bulk matches in search engines

This is a pet peeve of mine. What I mean by bulk matches are companies who buy a match to ANY words entered into the search engine. For example I recently typed in Dot Net into the search engine (I meant to type some more, but hit return on accident). The sponsored sites on the side were all “dot net” in the title, and NONE of them had ANYTHING to do with Dot Net.

ToSeeka… Looking for Dot Net? What do they know about it? Nothing, they are just trying to send you to another search. Why?

Findstuff – dot net – Review & Compare! Clicking on the link takes you to another search portal. NOTHING relevant. They just filled in my same search to their search engine.

Top7results – Get more results on dot net. Um, I am AT a search engine. Why would I go to yours to get more results when I could click the next page on the one I am at!

Search engines race to collect money

Search engines should be ashamed of themselves. They are just collecting money for wildcard matches. They don’t care if it is relevant or not (apparently). But I thought search engines were support to be in the business of providing you relevant information?

These types of matches hurt everyone who advertises

Want to know why your PPC (pay per click) advertising has gone downhill? It is because users are learning to ignore the right side of the search because 99% of the time it contains junk today. It contains links to search portals, collections for parked domains that send you to another search portal, and flat out wrong sites with wildcard matching on keywords.

I do remember a time when over 95% of the people who clicked on our PPC links bought something from us. Users use to trust that the links were accurate and the company was legit. Today I think most users are jaded by the constant bombardment of the junk in sponsored links so they ignore them. Four years ago we saw a click through rate of 7-10% with an almost 100% conversion. Today we see 0.04% click through with around 10% conversion. Click fraud, search engines taking money from whoever will give it to them, and jaded users are to blame in my opinion. I personally see this type of keyword buying as another form of spam, but that is just me.

Safe to View IE Toolbar public beta released

Emerald Technology, Inc. — Sat, 17 Feb 2007 11:09:27 GMT

Safe to View safety toolbar released

What is it? Safe to View is an Internet Explorer 6/7 toolbar addin. It shows you while you are surfing the web if a site may be threatening to you or not. There are also over 40 categories of domains for you to choose the type of content you want flag as objectionable.

Did you misspell the domain name again? We could have blocked that parked domain from sending those two dozen popups your way.

Sick of search results that are 50% or more parked domains just trying to send you to another search portal? If we know about the parked domain, you will be notified.

Is it a web filter?

OK, so what does that really mean? Is it a web filter? No, it is a NOT a web filter. It does use the same database as our web filter, and you can use the same categories. But anyone can turn off an IE toolbar in about five seconds flat. It is a tool to inform you about the sites you are visiting.

Can parents use it as a filter?

First, I don’t like the idea of parents shucking off their responsibility on a piece of software and then saying “There, I am done as a parent”. The Internet (and life) is much more complicated than that. This is a tool to talk with your kids, explain to them the risks of sites and why they don’t want to visit those types of sites. Yes, it can stop them from going there. But, any kid can turn it off pretty easy. This is not intended to be a baby sitter.

Can I install it at my business?

No, this is not for commercial users. If you would like to do that, please contact us and we will make arrangements for you.

What are we doing with this?

As many of you know we do have a web filter product (Emerald Web Shield). And our spam filter service uses domain databases to block objectionable email based upon the domain categories. Well, we took those two principles and put them together. The IE toolbar uses the same database and categories to tell you about sites you may be clicking on. Safe to View is something different.

First, it is a technology demo. We have a lot of partners (and hopefully potential partners) that are always asking about our database. This is a very easy way to surf the web and see what we think about sites in real time.

And it also allows each user to participate and give feedback on sites they find. Hit a site as a result of a search and it was a spyware site? Users can report it to us and help protect other users. Second, it is a protection system. We want to help people make informed decisions about where they go on the web. Very soon the website will be updated with user feedback and rankings (ala Amazon’s feedback system).

And third, it is an information tool. Many parents don’t know if a site their kid is visiting is safe or not. Looks ok, but how do you know? We want to be that information tool to help parents make informed decisions. Your child comes home with a new site from one of their friends and wants to go. Look it up and see what other users think about it.

Feature Roadmap

We already scan an incredible number of URL’ and domains every day as a part of our core business. Part of what we would like to add to the Safe to View toolbar is a virus warning as well. We will download any EXE, ZIP, PDF, DOC, etc document we find on the sites and scan them and report our findings. This is good for us, and good for the Internet community at large.

Reach out to new potential partners. We want to find new ways to use the data we already have. Have a great idea? Contact us, we would love to hear from you and work with you.

Search integration is a big deal for us. We have a way to tie in to the search at Google and MSN and show you the red, green, yellow icons for each entry returned by the search engine. We feel this is just a part of informing users before they go there. Well, it is never that easy. A large (ahem, names will not be mentioned) search engine threatened us with a law suit if we modified their results in ANY way. So, we are trying to work through this and come up with a way to do it (while not getting sued).

We have the ability to build our own search engine. A Safe to View search engine would be a very good thing in my opinion. The problem is how to make money from it? How do we support it? And does the world want it? When 75% of men admit to having searched for porn while at work is there a place for a search engine like this? I don’t know. We are building our technologies, and leaving the future to a higher power.

Download the safety toolbar and give us from feedback. It is free for non-commercial usage.

Office 2007 and SMS to your phone

Emerald Technology, Inc. — Wed, 07 Feb 2007 03:32:52 GMT

Office 2007 is out. I am sure lots of people are looking at it with a “so what” state of mind. I personally do not usually rush out and buy the latest and greatest Office. Since Office 95 I have found most of them to be incremental changes in nature. More bells, more whistles, more digging through endless menus to find what I don’t really need. Office 2007 is not like that. I have to say it is one of the largest upgrades I have seen. Microsoft really did their homework on the UI. The ribbon bar interface actually works.

Outlook is an app that is near and dear to my heart. I use it probably more than any other application on my system. I hated it for years and used Eudora as my email manager, and Outlook for tasks and appointments. About two years ago I finally upgraded to Outlook 2003 and started using it as my primary email system as well. Mainly because I bought a smart phone at the time and Outlook synced to the smart phone including email.

Here are a few of my favorite features in Outlook today. Most of them are available in any version of Outlook with the exception of the SMS Link (more than one that shortly).

Tools – Rules and Alerts

Did you know you can have Outlook Alert you when a certain email arrives? For me this is of course our contact us addresses, and anything from a customer. I have a number of rules setup to notify me in different ways depending upon the subject line, or the email address it is coming from.

You can now also have Outlook Alert you when an RSS Feed has been changed. Or if the RSS Feed has changed AND contains a keyword you are looking for, etc.

Tool – Options – Mobile – Notifications SMS to your phone

This has got to be the best new feature. If you are frequently away from your desk, but carry an SMS enabled phone you can have Outlook automatically forward emails based upon rules to your SMS phone. You can setup email address or keywords to flag the email. You can also tell it to only send the first SMS message of the email, or to break it up and send the entire message.

This comes in REALLY handy for those of us in IT that needs to know when systems go down. I have a number of servers that watch each other and email me with a message when a server is offline. I used to have to manually route those messages back to the Sprint messaging gateway to get them to my cell phone. Not too hard to setup, but not easy either.

Now after a brief wizard asks you for your mobile carrier, and walks you through some configuration steps you only have to check a box “send reminders to mobile phone”. That is it. You can get your daily schedule, todo lists, incoming email that meet certain criteria, etc. This means that even when you are away from the office you can be reminded of appointments. Very handy if you don’t have a smart phone, but have SMS ability. The best part is that there are no fees associated with this, and no server configurations. Since your Outlook is the one sending the SMS you don’t have to manage anything on your server. You can even hit the New button and select “Text Message” as an option. There is a little preview of what it might look like on a regular phone. Of course you have to already own a phone with SMS ability, and a data plan with that phone.

This is a feature that used to cost a lot of money to get from a third party. Now you can do it right within Outlook 2007. And it works really well. Each user controls their own settings, nothing to do on the server. I like that a lot.

And as a nice byproduct I now get all the contactus emails and any replies to them directly to my phone without have to check the email. Make us a more responsive company, and able to provide better support.

Here are some links to Microsoft for demos and trials of Office 2007.

NOTE: All of these demos are on the Microsoft site.

Office 2007 Test Drive – Microsoft has provided some very nice demo systems for you to place with Office 2007. You connect through the web to a preconfigured virtual machine. Nothing to install on your machine. They even give you some tasks to accomplish and help you work through them. Some of these tasks of course highlight features improved or upgraded in 2007, but most of them are just things you try to do every day.

Word 2007 Demo - Demo that shows the power of the ribbon bar and what you can expect in Word 2007. It is more of an incremental change to me. The ribbon bar is definitely a new way to work, and so far it has actually been very easy for me to learn.

Outlook 2007 Demo - Demo showing the new features of Outlook 2007. Notice there is no ribbon bar on the main screen, but there are when editing emails, etc.

PowerPoint 2007 Demo – There are a LOT of changes in PowerPoint. Ways to make your presentations look better, more dynamic. I know I always hate seeing the same templates in every presentation, now it is quite a bit easier to get something that looks nice without using two dozen functions to make it happen.

Excel 2007 Demo – A lot of really nice changes in Excel for people who use Excel not as a calculator, but as a reporting system. There are a number of very nice changes for building custom views of your data without creating separate sheets and charts.

SMS Link Demo - Demo of the SMS Link for Outlook 2007. There is also a step by step guide and instructions on how to get the most out of it. There is also a list of participating wireless providers to see if yours can use the system.

SMS Link Home at Microsoft - This is the main link to the Microsoft SMS page.

Update on our virus scanner plans

Emerald Technology, Inc. — Tue, 06 Feb 2007 10:50:23 GMT

Update on Virus Scanner changes

I have been looking at ClamAV for the past few days. I am very impressed. Not only have they managed to port the Unix anti-virus scanner to Windows, but they have done a good job of it. For those of you who do not know what ClamAV is I will provide a brief summary.

Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. Most importantly, the virus database is kept up to date .

They have also ported the base packages to Windows here. This is not a mere port. There is no Unix interop layer, and the ClamD (The service to use the windows terminology) is very small using less than 30 MB of RAM, and runs multi threaded very well.

If you are interested in their stand alone scanner take a look at the Clam Win site. This is the client experience application. It is a pretty good GUI, a scanning scheduler, auto downloading of updates, an Outlook plugin to scan attachments, and more. This is a LOT to offer for free. Now you have no reason not to install an anti-virus on all your PC’s. The only option missing from the system is a real time scan system. I personally have never really been a big fan of them since they can really impact your system performance. I almost always have mine turned off on my other systems.

Why use a client server anti-virus scanner?

Our current solution from F-Prot is not a client server system. So this is the basic flow that happens for each email:

· Email and file attachments are stored to disk

· Command line scanner is run

· Command line scanner has to load the entire virus database into ram

· File is scanned

· Result is returned and all memory is freed up

This is how we have done it since 2003 when we added the anti-virus scanning to the system. It is not very fast, but it does work. And since F-Prot was charging us a very good price I was willing to live with the performance hit. It has caused us a few backlogs over the years waiting for the scanners to finish files, but not enough to really worry about it. The “big guys” have nice SDK’s that you call in this manner:

· A service is started at Windows startup that loads the virus database

· Email and file attachments are stored to disk – OR – streamed across a socket to the service

· Command line scanner only contacts the service to tell it what to scan (very small memory footprint)

· File is scanned by the service and the result is returned

Obviously this is a much more efficient way of handling the files. But we could not afford to use most of these SDK based products due to costs. One vendor wanted over $4,000 for the SDK, and then to charge us over $10,000 per month for an unlimited mailbox license. No way is that cost effective.

Well, guess what? Clam AV has both of these models implemented. You can scan one file at a time, or use the service. Your choice. You can even install the scanner on a Unix machine and scan from the Windows to the Unix machine. Now that is what I call flexible.

The tests I performed

I have quite a huge sampling of spam and virus attachments on my drives since this is what we do for a living. So I took a small sample of 27,498 emails (246.3 MB) that arrived in our spam traps and ran them through the system. My first test was our existing F-Prot Version 3 engine. Then I tried the F-Prot Version 6 (new version). Then I also tried the Clam AV command line scanner, and the ClamD (think client / server) version as well. In all cases these files were in a temp directory on my drive locally. All of these tests were performed on an Intel Core 2 Duo CPU with 4 GB of RAM.

F-Prot Version 3
This is the system we have in place right now. It can scan at a decent speed, but is not the best solution for the reasons mentioned above. The files that were skipped are an oddity to me. None of them were really bad, they had bad encoding due to spammers doing crazy things, but the anti-virus scanner should not skip them in my opinion.
Files Tagged: 34
Files Skipped due to Error: 29
Total Time: 21:02

F-Prot Version 6
Not sure why they jumped the version numbers this way, but they did. This is the new model and will cost us a LOT more money if we were to deploy it. They have changed their licensing and we would no longer be able to use the versions that we have in place right now. F-Prot does have an SDK now, but it is not available to mere mortals like us without a lot of NDA paperwork and contracts - no thanks.
Files Tagged: 34
Files Skipped due to error: 24
Total Time: 1:18:34

ClamAV Command Line
This is the true apples to apples comparison because this version is a command line scanner just like F-Prot. It has different return codes, but it works basically the same way. Notices that zero files were skipped. Maybe they couldn’t decode them either, but they did scan what they found anyway. And they actually managed to tag two of the “bad” files from F-Prot as I-FRAME exploits. Kudos to ClamAV!
Files tagged: 36
Files skipped: 0
Total Time: 31:18

ClamAV Client Server
Now this is not the best comparison since F-Prot is command line and this is client server, but I am going to do it anyway. Same options as the ClamAV command line scan above, but with a much faster completion time. By far the fastest, and if I were to actually spin up two or more of these it can take advantage of the dual core chips much better since we are not duplicating the 25 MB virus database in ram for each instance. Running several threads did not provide a linear speed up mostly because the drive starts to become the limiting factor.

Single Threaded Test
Files tagged: 36
Files skipped: 0
Total time: 9:21

Five Thread Test
Files tagged: 36
Files skipped: 0
Total time: 5:47

Now I know some people will say that I could spin up multiple copies of the command line version as well. And you are correct, but I would be paying a much larger price in terms of memory usage. For each app that starts we would use approximately 28 MB of RAM. So starting five copies means you use 140 MB of RAM, where the ClamAV service still only uses that base 28 MB.

Should you get rid of your local anti virus?

Absolutely not. This system is not a replacement for other ways bad files get onto your system. And like any software it is not fool proof. Having more than one vendor scanning for bad attachments is always a good practice. You can just look at our service being your first line of defense, but you still need a local scanner.

What does all this mean?

OK, sorry for the rather long winded explanation as to why I think we are going to change our anti-virus system to ClamAV. It will mean less CPU usage, which means that we can continue to offer the best prices for our customers.

We are going to deploy the ClamAV system onto our spam traps and beta servers and evaluate it further. Make sure there are no crashes, memory leaks, etc. This is a normal deployment scenario for us whenever a component changes. We implement it internally, and then stage it to the beta servers. Our spam traps generate a TON of attacks and some really bad virus attachments, so it is a logical place for us to test this as well. If all goes well I expect to announce that we are moving everyone sometime in early March 2007.

As always, any concerns or feedback is greatly appreciated.

Anti Virus prices going up

Emerald Technology, Inc. — Tue, 30 Jan 2007 19:26:40 GMT

As we have discussed before we use F-Protect as our antivirus solution on our servers. Well, a new version of F-Protect has been released and they are changing the pricing model for servers. We have a corporate license agreement with them that expires in March, so look for prices to go up when we renew. I don't agree with their new pricing model, but we don't have much say in the matter either. (Let's just say the cost to us will be FIVE TIMES higher than what we pay now)

Pricing is now based on the number of mailboxes scanned. I don't understand why though. They don't pay for the CPU time, I do. There is no difference to them if I scan 10 files or 10 million files. I am the one paying the CPU time. The updates are the same. There is not even a real API to call their system, we use a command line app that returns status codes to us. That has been OK with us in the past because they were so inexpesive compared to the big guys. But the big guys have fancy API's that you call in process and avoid a lot of CPU overhead. I always figured it was a price / performance trade off. Now we are going to have to evaluate if F-Protect is the right antivirus vendor for us.

We had avoided most of the other vedors because they were extremely expensive for a small service like ours. Some of them were $4,000 or more for the server, and then you still had to pay on a per mailbox basis. That is just too expensive. We may have to look into ClamAV or some of the other smaller vendors out there. I had liked F-Prot because they always scored a 10/10 on all the antivirus roundup tests.

Anyone else have an anti virus solution that is cost effective for small business?

T-Mobile free Wi-Fi for Vista users

Emerald Technology, Inc. — Tue, 30 Jan 2007 00:36:51 GMT

Reading the Microsoft Watch blog I found an article that I think everyone might be interested in. You can get free Wi-Fi access at T-Mobile locations if you own Windows Vista from now until April 30, 2007.

That site gives you a link to a semi-funny site about Vista and Wi-Fi networks called Sky Surprise. They have cooky russian cosmonauts telling lame jokes. I am not sure why, you will just have to go look and tell me if you get it.

New File Formats for Office 2007

Emerald Technology, Inc. — Fri, 26 Jan 2007 21:25:15 GMT

New file extensions in Microsoft Office 2007

Microsoft has changed all their internal file formats for the new release of Office 2007. They are almost all XML based now, and they are open and documented. This is good news going forward, but could be a problem for a while until everyone gets upgraded. Fortunately they have provided the ability to “save as” an older format so you can send them to existing users, and they have added a few new nice changes as well.

PDF from Office
You can now save as a PDF direct from Office 2007 almost everywhere. It is not “built in”, but a free download from Microsoft’s site. The presenter at the show said that was due to legal reasons. Don’t expect to digitally sign or anything fancy with the PDF, but you can make basic PDF files with ease. And let’s face it, that is what 99% of the people do with the Acrobat system right now. Basic PDF output. That is why Adobe made the “Adobe Elements” product line. It could only make basic PDF’s, but they still charged you a license fee for it. You cannot import PDF files back into Office 2007 either. Only very simple output. So it is not a replacement for Acrobat, but it will meet the needs of most of your staff.

XPS File Format
XPS is a new file format for Windows Vista, but you can get viewers for it for legacy systems as well.

Here is the official text:

Document Experience

In Windows Vista, you can easily create a document in a paginated, fixed-layout format. An XML Paper Specification (XPS) Document is a page-by-page view of the document's content as it would be printed. In other words, it turns on-screen content into true electronic paper.
The XPS Document Viewer comes with Windows Vista and is also available for Windows XP and Windows Server 2003. The XPS Document Viewer allows you to open and read XPS Documents without using the original authoring application. You can also use the XPS Document Viewer to view and apply digital signatures to XPS Documents. The XPS Document Viewer is a Windows Rights Management Services (RMS)-enabled application so that any XPS Document protected with Windows RMS can be authenticated by the viewer.
2007 Microsoft Office system applications can create XPS Documents from within the application, making it very simple to create XPS Documents from applications you are already used to using. The Microsoft XPS Document Writer can also be used by any Windows-compatible application to easily create an XPS Document. The Microsoft XPS Document Writer is a print-to-file converter that creates XPS Document files.

Sounds a lot like a competitor to PDF, right? Here is the link to download the XPS viewer and more information at Microsoft.

Microsoft XPS Viewer

File Extension Changes

Most of the new file extensions are the same base, but with an X at the end for XML. So a Word .doc file becomes a .docx file.

These are the file extensions we will be adding to the default block lists of each customer. Feel free to edit them as always. Many of these can be used to install macro and plugin systems to Office 2007, so we are recommending you block them by default. It is only a matter of time until some hacker comes up with a clever way to use them to attack users.

XLSX, XLSM, XLSB, PRN, SLK, XLA, XLAM, XPS, DOCX, DOCM, DOTX, DOTM, MHT, MHTML, PSW, PWD

We will be adding these to accounts over the weekend and will post a note in the account alert when it is complete. If you do not want us to add them please let us know. If we see you have made major changes to your file list we will ask before making changes.