WinPatrol Crash Reported; Solution Available

I have suddenly received a number of reports that WinPatrol is crashing after new alerts are displayed. As soon as you try and respond Yes or No, the WinPatrol monitor dies.

If you have experienced a crash or screen like I’ve displayed below I have an immediate fix you’ll want to know about.  You can use the solution provided here and watch for a new version which should be available by tomorrow..


It appears this new error could be related to recent updates of either Windows, Java or Flash. Ironically, it started to happen right after I wrote a critical article about updates adding the Ask Toolbar and/or McAfee Security Scan but I would hate to think it's related. The only reason I installed both Java and Flash was to capture screen shots for my blog article.

The most likely cause of this problem is something included in the recent Windows Update.  I hope to isolate the problem so I can report it to Microsoft.  Unfortunately, my first priority is to respond to all the Email from WinPatrol customers.

I have duplicated this behavior and I have already have created a version that works. I had hoped to include more features in the new version but instead I will be testing it today and it will be available as soon as I'm comfortable.

I have found that downloading the WinPatrol Enterprise Edition will fix this bug. This version 26.5.2013 is available at http://www.winpatrol.com/download.html and can be used by both Free and PLUS users. You don’t have to subscribe to WinPatrol Enterprise.

The other easy solution if you really miss having Scotty on patrol seems to be removing the check box on the Options tab that says, “Share real-time cloud choices”. I haven’t fully tested this but it is something related to code which happens immediately after you make a choice on the Alert screen. What WinPatrol keeps in our cloud is the decision you make on keeping or removing a program. We collect these choices and make the totals available to WinPatrol PLUS members.  This feature helps you make a decision based on the choices of other WinPatrol users. After we fix this bug I hope you’ll recheck this option and participate so WinPatrol users can continue to help each other.



If you notice problems this week with other programs I would be interested. For instance, my laptop is now failing to play sound and I get a message about my sound driver. While I can fix the WinPatrol bug I’m anxious to know why it suddenly occurred and which Windows Update resulted in this change.

If you see anyone post about this problem in a forum feel free to let them know about this solution.  Testing the new version will take priority over my participation in forums or responding to most Emails today. I am confident that I will have a new fully tested build by the end of the day.

Another bit of irony, one of the new features planned for the newest release is a way to notify users when a new version is available. That feature has been tested and will be included in the new version.

Death of the Personal Computer Due to Greed

I’ve read a lot of predictions about the death of the PC. Most of the articles assume the blame is due to the surge inthe use of tablets and powerful smart phones. If you’re seeing the same updates that I do you’ll agree the real death may be due to user apathy and greed.

In the early 80’s I remember a similar situation in a growing game market. Despite innovations in hardware a flood of poorly written, badly designed game cartridges killed the growth of gaming and home based consoles.

I’ve written a lot about the various ways software in the personal computer market is failing. It’s now obvious that I was forecasting the death of the personal computer as we now know it.

Last October I wrote about “The Dangers of Downloading Free Software”. The previous year I focused on “Dangerous Downloads on Legitimate Websites & Search Engines”

The New Business Plan, Installing Unwanted Software
A number of my posts have been warnings about unwanted software like toolbars. I have discussed the potential revenue I gave up in “Would you like Toolbar with your Software Order?” (Jan 2008) and “No, I Don't Want Your #^$% Toolbar” (March 2009)

Recently, I actually begged people to remove a Java security risk and pointed out how Oracle was trying to install the Ask.com Toolbar on each update of their flawed software. I had forgotten that even before Sun was purchased by Oracle they were pushing the MSN Toolbar and I included screen shots in my post “Sun Java Promoting Microsoft Toolbar” (April 2009)

Most friends followed my advice about current threats from Java but this week I am alerting friends that Adobe is updating their popular Flash program.  I’m starting to sound like chicken little.

The Sky Is Falling
Adobe is also doing their part to add more frustration to personal computers. Their practices are sure to send users running to other devices. When you download the necessary security update, Adobe will push another program depending on your browser. Software companies like Adobe are counting on you not to pay attention. Adobe gets a royalty every time someone doesn’t read directions.

When using Internet Explorer, Adobe tried to trick me into changing my default browser to Google’s Chrome. If I don’t uncheck the box, Chrome will be installed and becomes my default browser.  Google will pay Adobe for each successful install. Even if I switch back to IE, it will now include the Google toolbar.

When using Chrome as my browser, Adobe tries to get me to download something called the McAfee Security Scan PLUS. Their logic is “It’s free, so we’re doing users a favor and making money in the process”.

We all know you’re not going to read and agree to the software license but even worse, this update adds complex software that will most likely disable the current antivirus software that you’ve trusted and may still be paying for. ”Temporarily?”  I don’t think so.

Security Updates Important, Yet Risky Every Time
Every time a user mistakenly allows the installation of a 3rd party program Adobe makes money. These opportunities don’t just happen the first time you install their product.  Every time there is a required update you’ll need to remember to uncheck the extra program or new changes will be made to your computer in ways you’ll never know.  In the case of Adobe Flash, just this month they’ve advised users to update six times.

If you think Flash looks bad take a peek at the security updates recommended for just one version of Adobe Reader and Acrobat used to read PDF files. Additional versions are listed on their website since they include these programs in new computers and other programs.

Meanwhile, if you didn’t notice the check boxes you’d end up with all sorts of new startup programs that will slow your computer down.  Having WinPatrol™ as an extra layer of protection I could have prevented these programs from being added but I wanted to see what would happen.

WinPatrol Startup Programs List showing recent additions

This just shows new Startup Programs and doesn’t include additions to the Schedule Task list, new Services that were added and registered ActiveX controls.

All the auto run or Startup Programs added on 2/27/2013 were the result of installing Java and Flash.  I’m not sure who added Microsoft’s Security Essentials but if you notice the time listed under First Detected you may notice a neat deceptive trick.  The Ask Toolbar Updater from our friends at IAC waited 10 minutes before adding their entry in an obvious attempt at hiding their intrusion into your computer.  Using WinPatrol also provided a layer of protection which warned me of this change even 10 minutes later.

Which is Worse? Insecure Software or Deceptive Downloads
So, again I find myself disgusted and fearful that this has become a common acceptable practice. I’m not sure what bothers me more. Is it that these major companies keep having dangerous security vulnerabilities due to sloppy programming or that they misrepresent their updates by including unnecessary software.

I continue to have companies contacting me with offers to add extra software to my own install program. I refuse the offers and perhaps WinPatrol will suffer a fate similar to the personal computer but I’ve made a promise I intend to keep.

The Risk of Adding New Programs
Any time a program is installed on your computer there is a risk. I was reminded the hard way researching this article. I don’t know which program caused the conflict but in the middle of my test I discovered I no longer have sound.  One of these new programs or updates caused a problem with my sound device driver which hasn’t had a problem in over two years.

It looks like my PC is on its way of being dead.  It didn’t help to see that my own program was being attacked as part of this widespread third party software scam.

Remember the warning that installing McAfee with Adobe Flash may disable your virus program? It seems my settings weren’t agreeable and Adobe or McAfee decided they didn’t want WinPatrol providing a warning that may impact their revenue.

Once I got past the  installation process,  I found that the McAfee Security Scanner Plus and WinPatrol both ran together without any problems. 

While I have mentioned it, the solution isn’t to download my WinPatrol program. I really hope you’ll let Oracle, Adobe and others know that this behavior is unacceptable. Let them know we know what they’re doing and it’s killing the personal computer market. I now use a 3rd party PDF reader, I will support HTML 5 instead of Flash and I’ve even purchased my last copy of Photoshop.  Meanwhile, be careful out there and be sure to read the screen.

The Power of WinPatrol Enterprise Now Available

Over the past year a custom version of WinPatrol has been quietly available to a handful of companies that requested a little extra support for features they needed. These features required some custom programming, support and server activity so in the past they weren’t available to all WinPatrol PLUS members.  

Due to popular demand I have standardized these features and developed an easy to use, secure interface. These features are now available to other business customers and perhaps even families with multiple computers. Even if you don’t need the subscription to WinPatrol Enterprise, the newest version(26.5.2013) is still available with a few bug fixes to current FREE & PLUS users http://www.winpatrol.com/download.html.

The main focus of WinPatrol Enterprise is to have a single WinPatrol Administrator keep watch over changes made to systems used by individual employees or family members. When a change is detected an Email will be sent to the WinPatrol Administrator. The Email will include date/time, unique ID, type of change, full filename and other useful information.

The Enterprise service requires regular maintenance so this feature is available on a subscription basis. The cost will be minimal and each subscription may be installed on up to five machines.  Each of these machines can assign a designated WinPatrol Administrator who will be notified of any alerts and/or changes made by an employee or family member.

In addition to notifications we’ve enhanced the ability to hide alerts so a user won’t have their work interrupted. Alerts can be disabled and the WinPatrol Administrator can define the default action that will take place without user input or confusion.  On the same screen it’s possible to disable the WinPatrol system tray icon so many users won’t even know WinPatrol exists. The WinPatrol Administrator will be needed only in extreme cases.

This procedure is not meant to be a way to spy on employees. Anyone who has WinPatrol Enterprise installed on their computer must be notified.
At this time, an administrator may not make changes without logging into the machine which has WinPatrol Enterprise installed. If these features were built in WinPatrol Enterprise it could be abused and I feel it’s important that WinPatrol could not be used by stalkers.  If you wonder why I’m against blind monitoring just visit my friends at the National Network to End Domestic Violence.

When an change occurs the WinPatrol Administrator will receive an Email that will look something like the following…

Alternate formats are currently being developed. This has worked in the past for our business customers but I’m open to suggestions of other useful data.

Click to Download WinPatrol Enterprise Edition.

Banking System Fails Due To Security Question

The biggest threat to your security may be the answers you’ve given to security questions. You could have the wackiest combination of characters in your password but it won't matter when someone can easily find out what high school you attended. 

If you’ve been paying attention to computer news you may have heard that the US Federal Reserve Bank was hacked. Details on over 400 bankers was stolen although the Fed won’t say what the “Details” are.
You may have also heard about the Bush family being one of the many hacked due to a flaw in Yahoo’s Email service. One flaw they have in common is an outdated method to reset your password.
This week I discovered one reason banks have failed to provide accurate security all the way up to the top.  It took me 3 minutes to find that Fed Chairman Ben Bernanke’s mother’s maiden name was “Friedman”.

I recently realized the company providing services to my small town bank is still living in the 70’s and probably still stores my information on magnetic tape reels programmed in COBOL According to its website Fidelity National Information Services or FIS is the world’s largest global provider dedicated to banking and payment technologies.


I’m a big fan of security questions but not when multiple sites use the same questions.  It’s especially scary when I see what must be the first security question ever used. Mothers Maiden Names?

Even if you can’t remember multiple passwords what I recommend is creating standard replies for common security questions.  Since most answers to security questions can be found on Facebook your answers to security questions should never be truthful.

What’s your favorite book? Your answer should not be The Bible, The Hobbit or 50 Shades of Grey.  It won’t be hard to remember, “Jokes for the John” or “Green Eggs and Ham”. Just associate your answer with a common theme.

Where did you go to High School? NEVER give your real school. The kids on Happy Days went to Jefferson High.  Use your own imagination and make up a high school name you’ll remember.

Where were you born? How about Taxicab or Seattle Grace?

The name of your first pet?  How about Dino? Even if your dog had a different name, don’t use Snoopy or Lassie as fake answers. They’re like using 12345 as a password.

Now that I’ve used these examples I wouldn’t use any of them but you’ll find it’s easy and fun to come up with fake answers. Create fun fake answers that are so funny, you’ll be sure to remember them.  And if they ask you for your mothers maiden name, go complain to your bank manager like I plan on do.

While I can’t say the recent Federal Reserve attack was due to a common security question the screen shot from my bank is real.  The number of hacks that begin with a simple security question is undeniable. As a security professional I’m embarrassed it took this long for me to write about this problem. Just ask Sarah Palin what high school she went to and you’ll be reminded this problem has been around for many years.

Update March 23, 2013: I neglected to mention one other important related tip. When asked for your birthdate always use another date you'll remember. Recently, it was revealed that anyone could obtain the password for an Apple account, like iTunes, by knowing a users Email & Birthdate.  The Verge, March 22, 2013

Updating your Twitter Password Isn’t Enough

It happens so often that many of you probably ignore the newest reports of a bank or web service being hacked and personal information being stolen. Most news stations probably have a macro they can just fill in the variables that looks like “Today <X> was the victim of hackers. Information including name, passwords, credit card information, and <Y> for more than <N> customers was stolen and is now being sold online to other hacker groups.”

Most companies do little to notify customers and have a policy to reduce the severity perception of any attack. The common response is “No indication of customer data being abused has been reported”. In severe cases a company may offer free credit report monitoring for a year to their customers. Unfortunately, this typically requires you to sign up using a credit card and unless you remember to cancel you’ll automatically be renewed and charged for any future years.

Twitter says “attack was not the work of amateurs…”

Today, the public news report is that information from approximately 250,000 Twitter accounts was stolen. Twitter has taken action but I recommend you do more than just change your password. Even if you don’t use Twitter this attack may still affect you.

1. Immediately try to sign on Twitter and change your password. If your account was compromised Twitter may have already changed your password and you won’t be able to sign on. Don’t keep trying to sign on or you may be blocked.  Even if you weren’t a victim, tell Twitter to send you a password reset link to your associated Email address.  Check your Email and create a new password that you’ll remember and is different than your current password.
   
   
2. Important: If you used your Twitter password or even something similar on other services like Facebook, start going to all the other services you use and change your password. I know keeping track of passwords is hard but hackers know you share passwords.
   
   The bad guys have automated tools which are now trying to use your Twitter Email and password to access Facebook, Google+, Gmail, Pinterest, Microsoft Live, LinkedIn,  Instagram, WordPress, BlogSpot and even GoDaddy.
   
   When you reset your password be sure to verify all the email accounts and cell phone numbers which are associated with your account. A hacker will add contact information so they’ll be able to re-reset your password and no matter how many times you change your password, they’ll still have it.
   
   
3. Just in case: Your Twitter account is associated with an Email address. Change the password on this Email account. While the attack will not expose your email password it may make the email known. Depending on your background you could become the target of future attacks and that email may be the key to many other desired accounts.
   
   
4. Be Smart: Be wary of ALL messages you receive from your friends especially on Twitter but also on Facebook, Email and other online services. If your friend had their account stolen they’ll most likely be sending out phishing attempts or links that will infect you. If you receive anything suspicious notify your friend immediately by phone and share these tips.
   
   
5. Twitter Apps: Even if Twitter changed your password you probably have accounts with one of the popular Twitter Apps.  You will need to update your new password on apps you may have forgotten are associated with Twitter.  Examples include,  “Twitter for Android”, “WeFollow”, “TwitPic”, “TweepsMap”, “Cert Me”, “Seesmic”, “Disqus”, “Pinterest.”
   
   See https://twitter.com/settings/applications to view your apps and clean up any unwanted application.
   
   
6. Remember to change the password on other Twitter accounts you have. In my case, one of my Twitter accounts was compromised but others were not. While my BillP account was compromised, I was able to sign on to my WinPatrol Twitter account without being forced to change my password. Imagine if I had used the same password for both accounts. 

I’m pleased Twitter has made this attack public and even better they are forcing a password change.  They risk losing customers but they risk a lot more if user accounts remained open.  

I received the following Email at 11:09 AM EST today letting me know of the attack even though the Twitter Blog reported the attack yesterday afternoon. It might be worth following @boblord, the Director of Information Security for Twitter or the official @Twitter company account.

Dear Twitter User:

As a precautionary security measure, we have reset your Twitter account password. Check your inbox for a separate email from Twitter with instructions on how to reset your password. If you don't see an email, you can go to this page in our Help Center to request a password reset. More information is below.

We recently detected an attack on our systems in which the attackers may have had access to limited user information - specifically, your username, email address and an encrypted/salted version of your password (not the actual letters and numbers in your password). Further information about the attack can be found in this blog post.

Since your password has been reset, your old password will not work when you try to log into Twitter. We strongly encourage you to take this opportunity to select a strong password - at least 10 (but more is better) characters and a mixture of upper and lowercase letters, numbers, and symbols - that you are not using for any other accounts or sites. Using the same password for multiple online accounts significantly increases your odds of being compromised.

For more information about making your Twitter and other Internet accounts more secure, read our Help Center documentation or the FTC's guide on passwords.

This attack was not the work of amateurs, and we do not believe it was an isolated incident. The attackers were extremely sophisticated, and we believe other companies and organizations have also been recently similarly attacked. For that reason we felt that it was important to reset your password and publicize this attack while we still gather information. We are also helping government and federal law enforcement in their effort to find and prosecute these attackers to make the Internet safer for all users.

Twitter

So, please take this report seriously and do the homework I assigned above. As I’ve pointed out, the impact of this exposure goes far beyond Twitter. I hope you all realize the danger of you or your friends using the same passwords for multiple log-ins.  Even though Twitter took drastic measures by forcing users to reset their password, many risks still exist due to this common behavior.