NBR: Privacy Policies: What are we really agreeing to?

I have been watching NBR (Nightly Business Report) for a very, very long time. Last night, it had an awesome segment on data privacy policies. They explained the data privacy issues so that the average user will understand it.

Everyone should watch this 5 minute segment:

Regards,
Roger Lacroix
Capitalware Inc.

Security Comments Off on NBR: Privacy Policies: What are we really agreeing to?

More Spam Garbage

For the last week, I have been receiving the following emails (and variations) to a variety of email accounts for the different domains I have. I have been laughing about it, deleting them and moving on. But today is Monday and I’m in no mood for this crap.

Hey dumb ass spammers, I’ll let some of it slide but don’t annoy me before my Monday morning coffee!!!

The email is an interesting threat but there are so many problems with it, I figured I would go through a bunch of them:

(1) You didn’t hack my email account (or accounts since I have received many of these emails). First thing I did was turn on “All Headers” in Thunderbird. The information was:

Message Id: rpapfg.h4vyn05g8k1ilhh@mail.rainvac.com
Return Path: marketing@rainvac.com
Received:
from server.rainvac.com ([67.225.188.99]:56969)
from 90-148-158-212.bluetone.cz ([212.158.148.90]:59400

So, an email account is hacked but it ain’t mine. Someone from the Czech Republic is logging into the marketing email account at “Rainbow Vacuum Specialists” and spamming the world with this garbage.

If anyone from “Rainbow Vacuum Specialists” reads this emails, would you please KICK your IT department’s CTO/director’s chair and tell them to get off there ass and fix the hacked account(s). Also, remove the malware that is installed too!!

(2) I don’t go to porn sites. Hence, no malware was installed on my PC. I also keep AVG software up to date plus I run TDSKiller at least once a week. My PC is my whole life, so I can’t allow anything to happen to it.

(3) I do NOT have a web cam attached to my PC. I just don’t have a need for a web cam. I’m not into video chatting. Hey, I’m a boring guy!! Also, if I was going to video chat then I would use my iPhone’s FaceTime. D’Oh!

(4) The nonsense about Facebook Pixel makes me laugh because it is just so dam funny. For those computer geeks out there, here’s the funny part:

Content-Type: text/plain; charset=UTF-8 

For those non geeks, basically the header says that the email is a Plain Text message (i.e. not HTML aka web) hence there could not be any tracking in the email. i.e. not like a web page.

So, here is the dumb ass’ spam email:

You may not know me and you are probably wondering why you are getting this e mail, right?
I’m a hacker who cracked your email and devices a few months ago.

Do not try to contact me or find me, it is impossible, since I sent you an email from YOUR hacked account.
I setup a malware on the adult vids (porno) web-site and guess what, you visited this site to have fun (you know what I mean).
While you were watching videos, your internet browser started out functioning as a RDP (Remote Control) having a keylogger which gave me accessibility to your screen and web cam.
After that, my software program obtained all information.

You entered a passwords on the websites you visited, and I intercepted it.
Of course you can will change it, or already changed it.
But it doesn’t matter, my malware updated it every time.
What did I do?

I backuped device. All files and contacts.
I created a double-screen video. 1st part shows the video you were watching (you’ve got a good taste haha . . .), and 2nd part shows the recording of your web cam.
exactly what should you do?
Well, in my opinion, $1000 (USD) is a fair price for our little secret. You’ll make the payment by Bitcoin (if you do not know this, search “how to buy bitcoin” in Google).
My Bitcoin wallet Address:
1CJRgpn87v1YU55xL5uzLQ8ekssiuHR7CE
(It is cAsE sensitive, so copy and paste it)

Important:
You have 48 hour in order to make the payment. (I’ve a unique pixel in this e mail, and at this moment I know that you have read through this email message).
To track the reading of a message and the actions in it, I use the facebook pixel.
Thanks to them. (Everything that is used for the authorities can help us.) If I do not get the BitCoins, I will certainly send out your video recording to all of your contacts including relatives, coworkers, and so on.

Ok, now I’m going to drink my coffee in peace.

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware Comments Off on More Spam Garbage

Sad News Regarding Søren Hansen

Today, I was trying to reach Søren Hansen of SystemUdvikling. His wife (Birgitte Ryberg) responded and said that Søren had died of cancer in December 2018.

I just thought I should let everyone know and express my sincerest condolences to his family and friends.

Søren ran his own company called SystemUdvikling. SystemUdvikling was a partner of Capitalware selling our products in Denmark, Norway and Iceland. For existing customers in those regions, you can contact us directly at sales@capitalware.com or for technical support at support@capitalware.com

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware Comments Off on Sad News Regarding Søren Hansen

Customer Requested Updates to MQMR

MQ Message Replication (MQMR) is an MQ API Exit. An MQ API Exit is configured to run within the queue manager’s address space (or the application’s address space if the application connects in bindings mode to the queue manager).

I designed MQMR to be extremely light-weight when replicating messages to target queues. MQMR determines if a queue will have its messages replicated when an application issues an MQOPEN API call. If MQMR determines that the queue name is a match then MQMR hooks into the MQPUT and MQCLOSE API calls, otherwise, everything related to the opened queue is ignored.

My thinking was that the MQAdmin and/or application teams would determine which queues would need to be replicated, the MQMR IniFile would be updated and during the next maintenance window for either the application or queue manager, the changes would be picked up when the application issues the MQOPEN API call after a reconnection.

A couple of weeks ago, a customer said they were making changes MQMR IniFile they were using and the new source queues were not causing MQMR to replicate the messages. I asked if the application(s) were connected to the queue manager (and stayed connected) before (and after) the updates were made to the MQMR IniFile. They said yes. So, I explained that the application needed to be recycled (or the queue manager). They explained that they were constantly making changes to the MQMR IniFile adding/updating/removing source queues. They requested that I make MQMR more dynamic, be able to accept and immediately implement new changes without requiring recycling of either the applications and/or queue manager.

My biggest concern with a more dynamic approach for MQMR is the memory usage. I already have customers using Capitalware products (i.e. MQMR, MQ Auditor, etc.) with queue managers installed and configured in VMs with extremely low memory allocations.

One application may open 1 or 2 queues, no big deal. The issue is that MQMR is an API Exit, so ALL of the applications connecting to a queue manager, opening queues will need to be tracked. There can easily be hundreds (or thousands) of applications connecting to a queue manager, each opening 1 or more queues. Now we are talking about a massive amount of memory being allocated and used by MQMR to track opened queues.

I reviewed the code and went crazy with a fine tooth-comb determining what was the absolute minimum memory MQMR would need to track an opened queue. I got the structure down to 70 bytes (62 bytes for 32-bit) and most of that is the queue name (48 bytes).

So, I have rewritten the internals of MQMR to be truly dynamic when it comes to an MQAdmin making changes to the MQMR IniFile. Any changes to the MQMR InFile will be immediately reflected in ALL instances of MQMR.

There are 2 small disadvantages to this new dynamic MQMR modification:

(1) MQMR will use more memory. Now, I have done my best to absolutely minimize the amount of memory used for each opened queue but MQMR will still use more memory than before.

(2) MQMR will be invoked for MQPUT and MQCLOSE API calls for all applications regardless if a source queue is being replicated or not. I added code at the very beginning of the routine for the MQPUT invocation to check if the source queue if being replicated, otherwise exit immediately.

I have completed a wide variety of tests and everything looks good. The customer is now also testing the latest release of MQMR.

If anyone would like to test out the latest release then send the email to support@capitalware.com

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Message Replication, Unix, Windows Comments Off on Customer Requested Updates to MQMR

Customer Requested Updates to MQCCI

In December, I had a call with a potential customer regarding MQ Channel Connection Inspector (MQCCI). Their security concerns were similar to what I posted several months ago in “So You Secured MQ But How Do You Know It Is Secure?“.

During the discussion, they brought up a couple of interesting comments:

  • How to correlate a disconnection audit record with a connection audit record.
  • How to track how long the connection lasted for.
  • I thought either the MCASecurityId and RemoteSecurityId fields of the MQCD could be used to correlate the connect and disconnection audit records but they pointed out that they were pretty sure that those fields only get populated on Windows platforms only. After the call, I did some testing on non-Windows platforms and I was surprised to see that they were always blank (null/binary zeroes). D’Oh!

    So, I decided to add a new keyword called: IncludeTag. If this keyword’s value is set to ‘Y’, then MQCCI will add a randomly genereted 16 character tag on both the connection and disconnection audit records. Hence, this will allow the MQAdmin or anyone else to correlate the connection and disconnection audit records.

    Since, I was messing around with the code, I also added another new keyword called: IncludeDurationTime. If this keyword’s value is set to ‘Y’, then MQCCI will add the duration time (disconnect time minus connect time) to the disconnection audit record. The time is outputted in seconds and microseconds. i.e. 25.123456

    If the keywords AddDiscMessage, IncludeTag and IncludeDurationTime all have their value set to ‘Y’, then this is an example of the connection and disconnection audit records:

    2019/01/03 13:45:13.445483, CONN, Tag=DxfsTJRFxcEG8dQC, CD_QMgrName=MQWT1, CD_ChannelName=TEST.CHL, CD_ConnectionName=10.10.10.10, , CD_ShortConnectionName=10.10.10.10, CD_MaxMsgLength=4194304, CD_PutAuthority=MQPA_DEFAULT, CD_MCAUserIdentifier=roger, CD_RemoteUserIdentifier=roger, CD_RemotePassword_Length=0, CD_SSLCipherSpec=, CD_SSLClientAuth=MQSCA_REQUIRED, CD_CertificateLabel=, CXP_PartnerName=roger, CXP_SSLCertUserid=, CXP_SecurityParms_AuthenticationType=MQCSP_AUTH_USER_ID_AND_PWD, CXP_SecurityParms_UserId=roger, CXP_SecurityParms_Password_Length=8, CXP_SharingConversations=TRUE, CXP_MCAUserSource=MQUSRC_MAP, CXP_RemoteProduct=MQJB, CXP_RemoteVersion=0800,
    
    2019/01/03 13:45:27.952108, DISC, Tag=DxfsTJRFxcEG8dQC, CD_QMgrName=MQWT1, CD_ChannelName=TEST.CHL, CD_ConnectionName=10.10.10.10, Duration=14.506625,

    The latest release of MQCCI for all platforms including z/OS is available for download. Send the email to support@capitalware.com if you want to try it out.

    Regards,
    Roger Lacroix
    Capitalware Inc.

    Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Channel Connection Inspector, Unix, Windows, z/OS Comments Off on Customer Requested Updates to MQCCI

    New MQCE and MQCT IniFile GUI Tools

    Since I had a little free time in December, I decided to create IniFile GUI Tools for both MQ Channel Encryption (MQCE) and MQ Channel Throttler (MQCT). Previously, I never bothered creating IniFile GUI Tools for those 2 products because they don’t have many keyword parameters but I figured “why not”, if it makes the MQAdmin’s job easier with an IniFile GUI Tool then fine.

    These IniFile GUI Tool updates are available for download. Send the email to support@capitalware.com if you want to use it.

    Regards,
    Roger Lacroix
    Capitalware Inc.

    Capitalware, IBM MQ, Linux, MQ Channel Encryption, MQ Channel Throttler, Unix, Windows Comments Off on New MQCE and MQCT IniFile GUI Tools

    Merry Christmas and Happy New Year

    I would like to wish everyone a Merry Christmas, Happy Hanukkah, Happy Kwanzaa, etc… and a Happy New Year. 🙂

    Regards,
    Roger Lacroix
    Capitalware Inc.

    General Comments Off on Merry Christmas and Happy New Year

    IBM MQ Fix Pack 8.0.0.11 Released

    IBM has just released Fix Pack 8.0.0.11 for IBM MQ
    https://www.ibm.com/support/docview.wss?uid=ibm10744749

    Regards,
    Roger Lacroix
    Capitalware Inc.

    Fix Packs for MQ, IBM i (OS/400), IBM MQ, Linux, Unix, Windows, z/OS Comments Off on IBM MQ Fix Pack 8.0.0.11 Released

    Here We Go Again!

    Capitalware is being forced to change our online shopping cart again. Ugh!

    When Capitalware started selling software in 2003 (yup, a long time ago), I signed up with RegSoft (owned by Digital River) to handle the online shopping cart. Everything worked well and I was happy with the setup.

    In January 2011, Digital River decided that they wanted to shutdown RegSoft and told all vendors that they needed to move to SWReg (another platform owned by Digital River). They made a mess of the migration process and I spent weeks fixing everything. Once everything was fixed, the shopping cart worked well, although the report generation has always been a bit lame.

    In August 2018, Digital River decided that they wanted to shutdown SWReg and told all vendors that they needed to move to Share-It (aka MyCommerce, another platform owned by Digital River). Once again, the migration process was less than perfect (not even close). Digital River said that SWReg is shutting down on December 31, 2018, so I have been taking my time fixing the various issues from the migration process for the last few months.

    I think everything has been fixed and I believe everything is ready to go. So, this Sunday (December 16, 2018), I will be publishing Capitalware web pages with the new links for the Share-It shopping cart.

    If anyone has any issues with purchasing any Capitalware products via the Share-It online shopping cart then please let me know ASAP and I will tried to get it resolved.

    Regards,
    Roger Lacroix
    Capitalware Inc.

    Capitalware, MQ Auditor, MQ Authenticate User Security Exit, MQ Batch Toolkit, MQ Channel Connection Inspector, MQ Channel Encryption, MQ Channel Throttler, MQ Enterprise Security Suite, MQ File Mover, MQ Message Encryption, MQ Message Replication, MQ Standard Security Exit, MQ Technical Conference, MQ Visual Browse, MQ Visual Edit, MQTT Message Viewer, Universal File Mover Comments Off on Here We Go Again!

    FreeBSD v12.0 Released

    The FreeBSD Release Engineering Team has just released FreeBSD v12.0.
    https://www.freebsd.org/releases/12.0R/announce.html

    FreeBSD is an advanced operating system for modern server, desktop, and embedded computer platforms. FreeBSD’s code base has undergone over thirty years of continuous development, improvement, and optimization. It is developed and maintained by a large team of individuals. FreeBSD provides advanced networking, impressive security features, and world class performance and is used by some of the world’s busiest web sites and most pervasive embedded networking and storage devices.

    Regards,
    Roger Lacroix
    Capitalware Inc.

    Open Source, Operating Systems Comments Off on FreeBSD v12.0 Released