Tech Blog

Technician performing cable certification testing on business network cabling

Cable Certification Importance

Reading through a whitepaper from an industry leader in structured cable certification and realized the importance and cost savings that comes from the certification process. Here is a summation of their findings:

Cable Certification Less Expensive Than Downtime

Running the numbers against enterprise sized environments showed that for an average cost of $750 worth of cable certification and repair the business was able to insure themselves against $67,000 of downtime. Consider how much each hour of downtime is worth to your organization then think about how much even 8 hours of downtime per year will cost you – that is the difference between 99.9% and 99.99% uptime.

Product Warranties Don’t Cover Workmanship

Even if you have product warranties from the manufactures of your network equipment and cable there is no guarantee as to the quality of the installation without cable certification.

Certification & Re-certification

The idea here is to future proof your business by making sure that cabling exceeds the current standards. This often can lead to extended return on investment (ROI) when newer technology standards are introduced and the current cabling can go through cable certification again to prove that it meets those standards. For example many Cat6 installations that originally were thought to be running at 1Gbps have been proven to run at 10Gbps over short distances thereby saving the company money and expanding their network bandwidth.

Cable Certification Saves Money

Landlords are mentioned here as a direct beneficiary of the cost savings inherent in cable certification. The costs of certifying a building full of cable prior to new tenants moving in is minimal in comparison with the cost of running all new wires – often only 5-10% of the cost.

Reducing Waste

Instead of demolishing current cable infrastructure to comply with National Electric Code standards of removing abandoned cabling, why not have the cable certification done to mark it for future use? It saves money and the environment

Unscrupulous Installers

No-name copper vendors are putting out so-called Cat5 or Cat6 cables that are manufacture outside the country with inferior goods and facilities. This is then used by unscrupulous installers to lower their overall costs whether or not they pass that savings on to the client. To avoid the use of these inferior cables make sure to only use vendors that supply cable certification for their work.

If your company is unsure about their current structured cable infrastructure or is looking to have new network cabling done, then contact us for assistance.

Missing Western Digital MyCloud Drive

Recently took over an account from another tech and was informed by the client that their Western Digital MyCloud drive was unreachable and they had not been able to access their files shared their with the computers in the office for some time. Since the MyCloud is just a simplified Network Attached Storage (NAS) device for the home / SMB market, I decided to go onsite and find out what was causing the issue.

How to find a missing MyCloud

I first investigated the shortcuts that were sitting on the desktop to figure out what was going wrong with the drive or if there were some bread crumbs as to where it was previously. Found one called Dashboard which pointed to an IP address on their current subnet that went nowhere – this was likely the former IP address of the device. Found a shortcut to the “Public” folder which pointed to an IP address that was on another subnet than theirs – this was likely from a setup before another network change and had not been removed since then. Found another shortcut to the “Public” folder which pointed to the same IP address on their current network as the Dashboard shortcut, so this confirmed that this was the last known IP address.

Ran a network scan using my personal favorite, SoftPerfect Network Scanner, to discover what was on the current subnet and if the MyCloud was still functional at another IP address. Found that the IP address for the device had changed to another similar address, so figured that it was getting its IP address from DHCP and when the old address lease ran out it just grabbed another one from the router. Checked the router and found that indeed the DHCP table contained the IP address for the device, so added a DHCP reservation to the router for that devices MAC address mapping it to the old IP address to make the broken shortcuts work again. Tested opening the dashboard and “Public” folders successfully which thankfully still had all of their information intact.

The final thing to do was to correctly set permissions within the device for each of the users and corresponding user folders within the device to allow them to connect and “backup” their documents to the device like they were used to. Although I would not recommend using this type of device to any of my clients, it was good to get this company backup up and running successfully. If your company is using Western Digital MyCloud drive for shared file access or are considering adding file shares to your network, then contact us for assistance.

Healthcare IT security professional reviewing audit logs to prevent Asante‑style employee data breaches and Yahoo‑type hacks

“Recent” Asante Employee Breach & Yahoo Hack

Very weird occurrence the other day, checked the post office box and found a letter regarding my son’s protected health information (PHI) had been improperly accessed in an Asante employee breach that started in 2014. Shortly there after upon returning home, found an email from Yahoo stating that they had been hacked back in 2014 and had just now finished their investigation which could have effected my wife’s personal email. Seems a strange coincidence that both firms had this happen two years ago and it took both firms two years to notice / do the investigation piece to rectify the situation. Here are some quotes from their responses:

Asante Employee Breach

“While Asante cannot provide details regarding the outcome of this internal investigation, we can assure you that we applied our employment policies and processes appropriately. A final audit of the employee’s actions showed that the employee inappropriately accessed records from August 18, 2014 to July 21, 2016 that may have included your child’s name, date of birth, medical records number, medications, diagnosis, and lab results… To date, we have no evidence that any patient information has been misused, nor do we have any reason to believe that the information will be misused. However, as a precaution, we wanted to notify you regarding this incident and assure you that we take it very seriously.”

Yahoo Hack

“A copy of certain user account information was stolen from our systems in late 2014 by what we believe is a state-sponsored actor… The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers.”

So these two things were not related but it is scary to think that it took two years to notice this activity. Even if Asante believes that the employee didn’t do anything malicious with the information, it shows that their information access policies and audit logging on them is severely lacking. They need to step up their game and possibly adopt some behavioral based analysis of the audit logs for inappropriate access like this in the future.

As for Yahoo, why are some of the security questions unencrypted while others were and were the passwords just hashed? If a state-sponsored actor had unsalted password hashes for two years before being detected then the likelihood of them being able to crack the passwords is extremely high. They also state that they are working closely with law enforcement on this one, but what is law enforcement going to do against another government’s hacking crew (aka state-sponsored actor)?

If your company is unsure of its information security posture or needs an evaluation of audit logging / reporting, then contact us for assistance.

IT technician removing Zepto ransomware crypto malware from infected business computer

Crypto Malware Zepto Infection

Recently had a client get infected by the Zepto variant of crypto malware without even knowing it. The call originated when they could not find some of the shortcuts they were used to seeing on the desktop. I began to search for the shortcuts and found some files with the .ZEPTO extension on them. A quick Google search found that this was indeed an infection of crypto malware but something was different about this one – there was no ransom note or instructions on where to send the money for the decryption key. After investigating the problem it seems that the user got an image file that they could not open and forgot about. They noticed some slow down of the computer the day that these files indicated that they were created but nothing else presented itself that day, so they dismissed it.

So here is breakdown of what actually happened. They were protected by Norton Antivirus and when the infection began to spread across the network (only a couple files were affected there) it removed the infection and left the damage done by Zepto encryption of some of the files in place with no notice to the user about what was done. The customer had a partial backup from a poorly designed backup scheme that was able to recover some of the files, which left them in a state of not knowing what was missing from their local file directories. Needless to say that I will be recommending a different antivirus and backup / recovery plan for them going forward.

If your company is not sure about whether your antivirus software is capable of handling this type of situation properly or are not sure about the status of your backup / recovery procedures, then contact us for assistance.

WHM AWS S3 Glacier Backup Setup

Amazon AWS S3 Storage to the rescue again with native support in WebHost Manager (WHM) to backup directly to S3. WHM AWS S3 Glacier backup is easy to setup and works like a charm. Included in this post are the standard settings that I use for all WHM backups.

WHM AWS S3 Glacier Backup Setup

Login to WHM and run a quick search for backup at the top left of the navigation pane
Click on “Backup Configuration” to begin setup
Under “Backup Status” choose “Enabled”, under “Backup Type” choose “Compressed” to save on bandwidth and leave the timeouts at their defaults
Under “Scheduling and Retention” choose to do a backup each day of the week and keep them for 30 days
Under “Files” choose to disable “Backup Suspended Accounts”, choose to enable “Backup Access Logs”, choose to enable “Backup Bandwidth Data”, choose to disable “Use Local DNS” and put a check next to “Backup System Files” to allow for full restores if needed
Under “Databases” choose both “Per Account and Entire MySQL Directory”, under “Default Backup Directory” type in:

/backup

Leave the “Retain backups in default directory” unchecked and disable “Mount Backup Drive as Needed”
Under “Additional Destinations” choose Amazon S3 from the drop down list and click on the “Create new destination button”
Assuming there is already a bucket and user created in AWS for this purpose – give the destination a name, check the box next to “Transfer System Backups to Destination”, type in the name of a folder in the bucket under “Folder” that will be created and used, type in the name of the “Bucket”, type in the “Access Key ID” and “Secret Access Key” then change the timeout to 60 seconds
Click on the “Save and Validate Destination” button to make sure all settings are correct
Finally click on the “Save Configuration” at the bottom to complete the WHM AWS S3 Glacier Backup setup.

Your WHM AWS S3 Glacier Backup has now been setup and with proper setup of S3 Storage there will be automatic archival too. If your company is using Amazon Web Services or S3 Storage for backup and need help getting it setup properly, then contact us for assistance.

Configuring AWS S3 Bucket Lifecycle Archiving

I am growing to love Amazon Web Services (AWS) S3 Storage. The AWS S3 Bucket Lifecycle feature is great for those using S3 buckets for backups. The lifecycle can be applied to the whole bucket or individual folders based on rules then set for auto archival or deletion based on those same rules. This post assumes that the bucket to be used for backups has already been created. For help setting up a new bucket read the AWS Documentation for a walk through of this simple process.

Configuring AWS S3 Bucket Lifecycle Archiving

Log into the AWS console and click into the S3 console
Click on the magnifying glass next to the S3 bucket being used for backup
On the right side of the screen, scroll down the list of properties to the Lifecycle item and expand it
Click on the “Add Rule” next to the green plus symbol
For backups, it is best to choose the whole bucket option in the “Apply this Rule to:” section of the wizard then click “Configure Rule” button
For the “Actions on Object” section choose the “Archive to the Glacier Storage Class” option with the “Days after object’s creation date” set to 7 days to automatically archive to S3 Glacier after a week. Choose the “Permanently Delete” option with the “Days after object’s creation date” set to 120 days to automatically delete from S3 Glacier after 4 months. Click on the “Review” button to continue.
Give the rule a name and click on the “Create and Activate Rule” button to finish the rule creation process
Make sure to click on the “Save” button to have the newly created rules saved.

Your AWS S3 Bucket Lifecycle has now been setup for automatic archival. If your company is using Amazon Web Services or S3 Storage for backup and need help getting it setup properly, then contact us for assistance. Look for the next post that will show how to setup WHM for backup to S3 Storage.

Configuring AWS S3 Glacier Backup User Setup

Working with Amazon Web Service (AWS) S3 Storage requires a user account, so it is natural to create a specific AWS S3 Glacier backup user account when connecting an outside service or device for backup purposes. This post will detail how to create a user that has full rights to a specific bucket on S3 and Glacier Storage so that backup files can be created or edited from an outside source.

AWS S3 Glacier Backup User Setup

Connect to AWS Identity and Access Management (IAM).
Click on “Users” on the left hand side.
Click on the “Create New User” button at the top.
Type in the username desired and leave the checkbox “Generate an access key for each user” checked then click the “Create” button at the bottom.
On this screen make sure to record the “Access Key ID” and “Secret Access Key” that will be needed when setting up backup service or device.
Click on the “close” link twice to exit.
Click on the username of the user just created, then click on the “Create User Policy” button to give the user proper rights.
Select “Custom Policy” then click on the “Select” button
Give the policy a name and then type in the following based on the S3 Storage Bucket (this will be setup in another blog post):

{
“Statement”: [
{
“Action”: “s3:ListAllMyBuckets”,
“Effect”: “Allow”,
“Resource”: “arn:aws:s3:::*”
},
{
“Action”: “s3:*”,
“Effect”: “Allow”,
“Resource”: [
“arn:aws:s3:::[S3 Bucket Name]/*”,
“arn:aws:s3:::[S3 Bucket Name]”
]
}
]
}

then click on the “Apply Policy” button.

Now it is time to connect the backup service or device using the AWS S3 Glacier Backup user with the “Access Key ID” and “Secret Access Key” recorded earlier. If your company is using Amazon Web Services or S3 Storage for backup and need help getting it setup properly, then contact us for assistance. Look for the next couple posts that will show how to setup a S3 bucket for automatic archival and how to setup WHM for backup to S3 Storage.

Check Amazon S3 Bucket Size via AWS Command Line

Had a web hosting client who wanted to find the offending large files that were costing them, so decided to check Amazon S3 bucket size and individual file size. Found out that the best way to do this was via the AWS Command Line interface, so downloaded it from here and used the instructions here to add the Access Key ID, Secret Access Key and Default Region to the AWS Command Line for secure connection.

Check Amazon S3 Bucket Size

Open the standard Command Line then change directory by typing the following:

cd %ProgramFiles%\Amazon\AWSCLI\
Type in the following to check file sizes on a whole bucket:

aws s3 ls –summarize –human-readable –recursive s3://[bucket-name]/
Or type in the following to check file sizes on a particular directory:

aws s3 ls –summarize –human-readable –recursive s3://[bucket-name]/[directory]

This was a huge help to finding the large files and directories with a simple Check Amazon S3 Bucket Size command in the AWS Command Line. If your company is using Amazon AWS S3 Storage for cloud storage or need help getting the cloud storage setup, then contact us for assistance.

AWS Command Line Interface User Setup

The most basic task needed to get started with AWS is to have a user account, so it is natural to create a specific user account when accessing AWS Command Line Interface (CLI) for a specific purpose. This post will detail how to create a user that has read-only rights to S3 and Glacier Storage so that bucket content size can be determined. The details of how to install the AWS Command Line Interface can be found here and details of the setup are in linked documents from there.

AWS Command Line Interface User Setup

Connect to AWS Identity and Access Management (IAM).
Click on “Users” on the left hand side.
Click on the “Create New User” button at the top.
Type in the username desired and leave the checkbox “Generate an access key for each user” checked then click the “Create” button at the bottom.
On this screen make sure to record the “Access Key ID” and “Secret Access Key” that will be needed when setting up AWS CLI software.
Click on the “close” link twice to exit.
Click on the username of the user just created, then click on the “Attach Policy” button to give the user proper rights.
Select “AmazonS3ReadOnlyAccess” and “AmazonGlacierReadOnlyAccess” from the list, then click on the “Attach Policy” button.

Once connected to the AWS Command Line Interface software commands can be run to check bucket content size which will be covered in an alternate post. If your company is using Amazon Web Services or S3 Storage and need help getting it setup properly, then contact us for assistance.

Remote Desktop Network Printer Redirection

Found myself setting up a client with a remote desktop connection to a local workstation from a remote site to use their Client Management System (CMS). Even after successfully getting them connected to the local workstation and warning them there would be issues with using their network printer at the remote office, they stated it would be just fine. Found out later indeed they were not able to use the printer successfully due to the inherent issue with network printers across a Remote Desktop Connection. Found this little workaround to provide Remote Desktop network printer redirection in the Microsoft forums:

Remote Desktop network printer redirection workaround

Click on the Start button and open Control Panel then open “Devices and Printers”
Right click on the network printer that needs to be redirected and choose “Printer Properties”
Click on the Ports tab and put a check next to “Enable printer pooling” and next to the “LPT1:” in the list then click the OK button to finish.
Click on the Start button and open Remote Desktop Connection then click on the “Local Resources” tab.
Click on the “More…” button at the bottom then put a check next to the Ports item then click the OK button.
Make sure to go back to the General tab and click on save before clicking on the Connect button.
Once connected download and install the needed print driver but do not create the printer itself yet.
Inside the Remote Desktop connected computer click on the Start button and open Control Panel then open “Devices and Printer”
Click on the Add Printer button at the top then click on the “The printer that I want isn’t listed” link at the bottom of the window that opens.
Click on the radio selection next to “Add a local printer or network printer with manual settings” then click on the next button.
Click on the list “Use an existing port” and choose “TS001:” which usually corresponds to the LPT1: port redirection, but it may take some trial and error going through this list later to figure out which one it is.
Search through the list of drivers to pick the one associated with the one being connected then click on the Next button.
If requested, choose to “Replace the current driver” and click on the Next button.
Change the name as needed and click on the Next button.
Choose “Do not share this printer” and click on the Next button.
Test the printer by clicking on “Print a test page” then click the Finish button.

If the printer does not print then open the printer properties on the Remote Desktop connected computer and change the port to TS002: on the Ports tab, click Apply then click “Print a test page” on the General tab to test again. Repeat down the list until the correct port is found. If your company is using Remote Desktop Network Printer Redirection or need help getting the network connected printers working properly, then contact us for assistance.