IT Professionals

Adobe Reader, You are Dead to Me

January 13, 2015 by Joe Hackman 3 Comments

Al Pacino is a very talented actor, if you’ve ever seen the Godfather you probably got the title reference. If you didn’t go watch the movies and I won’t spoil it for you. Even if you’ve never watched the film I am pretty sure you’ve used Adobe Reader at some point. PDF is a nice format because it is cross platform and allows lots of nice little features like digital signing, forms, among other things. Adobe Acrobat has become a kind of a necessary evil, frequent target of exploitation and all around general nuisance. This is my story of why I kicked Adobe Acrobat Reader to the curb and what I chose in it’s place.

Why I Don’t Love You Adobe Acrobat Reader

Over the last couple of years I’ve come across a number of little nuisance bugs with Adobe Reader. One of them was an issue preventing preview of PDF files in Windows. Recently I came across another fun little bug, I couldn’t print any PDF’s, I’d click print and instead of hearing the printer warm up I’d hear crickets. Kind of more than a little inconvenient. After researching a fix, the ONLY solution I found was to always select “print as image”. This combined with reading things like “Version x11 is buggy”, “you should probably use something else”. I am stubborn, so I dug in a little deeper and continued to seek a solution, then I reminded myself I really had better things to do with my time.

My Chosen Replacement – Foxit Reader

I jumped on Ninite.com to look for alternatives to Adobe Acrobat Reader. I remembered seeing a few in there last time I was getting some basic apps to get a new workstation up and running. After reviewing the list and doing a little research I decided to go with Foxit Reader. It seems to be the emerging leader in the PDF viewer world. One of the things I noticed right away that I liked quite a lot was that Foxit converted any PDF icons to mini-previews of the file:

Sexy Preview Icons

After opening my first few PDF files I noticed it had a tabbed interface with hotkey hint overlays if you hold down the alt key within the app, a huge improvement over Adobe Reader x11:

Tabbed interface with Hotkey Hints.

and we’re just scratching the surface here. Of course I had enough that I wanted to share and make jokes about lines from Godfather movies. I decided to leave off another Pacino joke “Say hello to my little friend, Foxit Reader.” another time perhaps.

A Side Note About Ninite

If you haven’t used Ninite, you should check it out. It’s great if you want to easily add or update things like Java, Chrome, Notepad+++, Irfanview among other things. Just go to the site, check boxes for the apps you want to install or update, click “Get Installer” and run it, done. You can even save the executable it generates and use it to update those apps at any time without user intervention. Imagine that. 🙂

Clever Criminals use LinkedIn Phishing Email [Video]

July 18, 2012 by Joe Hackman 2 Comments

Today I received connection requests for LinkedIn, only they weren’t connection requests for LinkedIn they actually contained links to a site with a Trojan Horse Virus. Since this message was fairly convincing I was concerned that some people might click the link and become infected. The purpose of this article is to arm you with the knowledge to avoid becoming infected by this and similar attempts. Three of the messages to the right are the result of the Kryptik.RY trojan and 1 of them is an authentic message from LinkedIn. The video below demonstrates how to avoid becoming a victim of attempts like this:

If you browser doesn’t support Flash or you do not see the video you can view it on You-Tube.

Have you received any of these messages yet?

Fixing Rackspace 2010 Exchange Spam Filtering

July 10, 2012 by Joe Hackman 1 Comment

How would you like to suddenly start getting all the SPAM E-mails your quarantine used to catch delivered right to your inbox? That is what happens presently when you upgrade to an Exchange 2010 plan on Rackspace if you don’t utilize the Junk E-Mail Filtering option within Outlook.

The Problem

The problem is two-fold, for starters the Microsoft Outlook Junk filtering is highly un-reliable. Too many messages you want to receive will end up in the junk folder forcing you to have to go find them. Couple that with the changes with Rackspace Exchange 2010 that require you to enable the junk filter or all the messages hit your inbox and you see an obvious problem.

A Solution

After discussing this in depth with Rackspace and hoping they would come up with a better solution, it became evident that they have no plans to change anything for now. In the meantime the best work around is to utilize the flag that they use tip off Outlook that the message is spam is via a simple line they add to the header:

X-Spam-Flag: YES

Instead of enabling the Junk Filter and fighting with it, you can create a custom rule in Outlook to filter these messages to a folder of your determination. In my case I used the Junk E-Mail folder that is essentially disarmed right now (filtering is turned off). You may wish to consult with your favorite/company IT professional before doing this.

Adding the filter

Here is a simple step by step procedure for Outlook 2010 these instructions assume Junk E-Mail filtering is already turned off on Outlook (this article demonstrates how to disable Junk Filtering):

In the Home tab of Outlook click Rules | Create Rule.
Click “Advanced Options”
Scroll down and check the condition “with specific words in the message header”
Click “specific words” and add: “X-Spam-Flag: YES” (minus the quotes) to the search list.
Click next, then check the box next to move it to the specified folder.
Click “specified” under the rule description and select the Junk Email folder.
Click next until you get to the finish rule setup screen, pick a name for the rule and check the box to run it now if you have spam in your inbox already (pictured).

Do you have a question about this article?

Leave a comment below, ask on our Facebook page or contact us.

Critical Java update and a stark reminder to update JAFO

October 21, 2011 by Joe Hackman 1 Comment

Java Logo The latest advisory for Oracle Java addresses a total of 20 vulnerabilities 19 of those 20 may be remotely exploitable. Remotely exploitable vulnerabilities are very high information security priorities because they can allow rapid propagation of a malware or computer viruses.

It’s time to add a new acronym

For some time now we’ve all learned that windows/operating system updates are pretty important but there are emerging threat vectors that also need to be addressed. Back in early 2009 a huge ramp up in volume of Adobe PDF and Java updates occurred. Since that time those two have become two very popular sources of computer exploitation. Add that to some recent nasty Flash exploits and you have the makings of a new acronym:

Always update JAFO:

Java
Acrobat
Flash
Operating System (Critical Updates Windows, etc)

Extra credit for the techie types, remember when Microsoft had their own Java Virtual Machine?

[polldaddy poll=5602313]

Duqu in the wild, not the drivers you were looking for.

October 19, 2011 by Joe Hackman 1 Comment

Duqu not Dooku, Image Credit Tracheotomy Bob

The Duqu Remote Access Trojan (RAT) that hit the wild in Europe this week is not a character in the latest Star Wars movie. While it sounds like a George Lucas inspired character duqu comes from the ~DQ prefix that researchers noticed this previously unknown malware was adding to files it creates when it was discovered. I am sure Dairy Queen is happy with their choice. Joking aside this virus is no laughing matter. It seems to have been written by the authors of or with the benefit of the Stuxnet source code. Stuxnet is the virus that was believed to have setback the Iranian nuclear program last year. It’s smaller and appears to be designed to spy on infected computers with a combination of a key stroke logger, a data siphon and remove itself after eluding detection for 36 days.

A new breed of threat

One disconcerting aspect of this particular Trojan is that one of the drivers in a variant used a signed certificate of a known organization in Taiwan. That means that a windows machine will treat that driver as a legitimate driver, just like one you’d download to access a new hardware device on your Windows PC. Luckily the certificate has been revoked. This particular malware mask’s it’s presence on the infected machine quite well providing a challenge to detect.

What can you do to protect yourself?

All of the best practices that apply to information security will help you avoid Duqu. This includes:

Keeping your critical components up to date.
Cautious web surfing and Email habits.
Avoid public charging kiosks.
Avoid flash drives from unknown sources.

Did you already get infected? You might want to visit the post virus opportunity center.

Can we prevent this?

Seeing as the machines that were infected with this Trojan were hit when it was “Zero-Day” it is prudent to consider what other means may have prevented the infection. If it ends up that this virus communicates with hosts in remote countries that a security solution I recently proposed would prevent the infection from transferring or downloading any information rendering it useless.

More information

If you found this article helpful or interesting please share it with your friends.