# Softpanorama, Vol. 8, No. 4. (Oct..1996) *** NEWS *** Compiled by N.Bezroukov

NEWS

# CONTENTS

CONTENTS

COMPUTER VIRUSES AND DATA RECOVERY

Viruses are more a probable source of data destruction than natural disasters, but lag behind hardware failures, human mistakes and software bugs…

Intel will release new versions of anti-virus products for Windows 3.11, Windows NT, and Netware…

Trend Micro Inc. has released anti-virus and security protection for Microsoft proxy server…

Norton Utilities 2.0 for Windows 95 3Lack of risk analyses in major IT companies… 3Archivers and backup software

Program analyzers and debuggers

OPERATING SYSTEMS SECURITY

Windows 95 Service release: Boot viruses could destroy new Boot Sectors and FAT32 partitions…

Microsoft will support Kerberos security architecture in Windows NT 5.0, due in beta in the first half of 1997.

Phoenix BIOS version 4, release 6 adds high-capacity floppy support and support of NT 4.0 on notebooks…

Security alert: new file formats in all Office 97 applications …

MASS STORAGE AND BACKUP

Reasonably priced 3.5-inch drives for backup in 7G range are available. Quantum will ship BigFoot 6.4G drive in Jan.97

SyQuest will compete with Iomega in 1G removable drive solutions…

Swan is the third major vendor that will ship 130M floppy drive…

14 and 16x CD ROM drives are expected in 1997…

ENCRYPTION PRODUCTS

Atalla plans to bring hardware-encryption technology into the Intranets

PUBLICATION AND REPORTS

CSI has published new Internet security manual

OTHER IMPORTANT NEWS

Compaq will not install Windows NT on its servers… 7

# COMPUTER VIRUSES AND DATA RECOVERY

## Viruses are more a probable source of data destruction than natural disasters, but lag behind hardware failures, human mistakes and software bugs…

Ontrack Data Recovery published a study, attributing 44% of all lost data cases to hardware failures, 32% to system administration mistakes, 14% to software bugs, 7% to computer viruses, and 3% to natural disasters.

## Intel will release new versions of anti-virus products for Windows 3.11, Windows NT, and Netware…

Prices start at $1495 per server. http://www.intel.com

## Trend Micro Inc. has released anti-virus and security protection for Microsoft proxy server…

IntelScan WebProtect works with Microsoft's Authenticode and permits the user to restrict importing of objects, 32-bit Windows applications, and Java applets. Price is $395 per server.

http://www.antivirus.com

## Norton Utilities 2.0 for Windows 95

New in the product are FAT32 support for Windows 95 and Crashguard, which protects users from losing data as a result of system crashes or freezes. Norton Utilities for NT is expected to be shipped later and will be available in the first quarter of 1997. List price is $79.

## Lack of risk analyses in major IT companies…

According to a study by technology researcher Datapro Information Services Group only 54% of IT companies surveyed (the survey, conducted in April, drew responses from 1,400 IT companies in the United States, Canada, Central and South America, Europe, and Asia) have a security policy in place, and only 15% use encryption to protect mission-critical data.

Risk analysis often is not performed at all, leading to a reactive rather than a proactive response to information security issues. Although 68% of respondents said they were concerned about security threats posed by Internet access, but only 28% deploy cryptographic software like PGP.

Although most companies are addressing disaster recovery in some way, only 19% have a disaster recovery plan in place. Many disaster recovery plans were created after the last disaster and are currently obsolete. If an organization hasn't updated it's disaster recovery plan within a year, it basically will not be able to use it.

More than 50% of European respondents reported having computer equipment stolen from their companies within the last year, compared with 25% in the US. This means that a hard drive on a laptop is at greater risk that if on the desktop and needs better protection.

## Archivers and backup software

Version PKZIP 2.5 for Windows 95/NT and Windows 3.1 is now available.

New versions have long file support and could be downloaded from http://www.pkware.com

## Program analyzers and debuggers

NYmega Technologies has shipped SoftIce 3.0 which is one of the most powerful debuggers for Windows NT and Windows 95.

# OPERATING SYSTEMS SECURITY

## Windows 95 Service release 2: Boot viruses could destroy new Boot Sectors and FAT32 partitions…

Microsoft Corp.'s Windows 95 Service Release 2 was shipped to PC manufacturers in late September. The entire Service Release will not be generally available to existing Windows 95 customers as an upgrade. Microsoft is distributing the package only to computer vendors. Although many of the application enhancements will be available online, Microsoft does plan to put the new hardware support in Windows 97.

Service Release introduced the FAT-32 (file allocation table) file system. Much like long file name implementation in Windows 95, FAT32 is a kluge and is inferior to HPFS or NTFS.. While 32-bit pointers double the size of FAT, they permit the usage of 4 or more times less sectors in a cluster for a given partition size. FAT 16 permits only 2^16 clusters (65,536) and the maximum size of FAT is only 128K. For example, 1G drive need to use 32 sectors in one cluster if we use FAT16. That means very inefficient usage of the disk if a lot of small file are stored because the minimum allocation unit is 32K. Maximum size of FAT32 is 2^32. If we limit size of FAT to 1M (256,000 clusters) then with FAT-32, partitions up to 256MB could use 1024-byte file clusters, up to 512M - 2K, up to 1G - 4k, up to 2G - 8K, up to 4G - 16K up to 16G - 32K, etc. Thus partitions in 1-2G range can be created with 8K clusters e.g. without wasting up to 20% disk space as at present. For 2M FAT size results could be even better, but access to 2M table will be a little bit slower.

New file system raises some security problems. MBR and boot sector format changes make new file system vulnerable to the boot viruses and old disk utilities like Norton Utilities. So backup of MBR and boot sector are vital. Also change of boot sequence to C,A is recommended. All programs that work with hard drive on sector level, including some antivirus packages must be upgraded to operate properly on FAT-32 partitions. Symantec Corp.'s 2.0 versions of Norton Utilities are FAT-32 compliant and currently shipping.

There are also some secondary FAT-32 compatibility issues: most current third-party applications and setup programs will now report incorrect disk usage numbers on large (more than 2G) partitions. Also FAT-32 partitions are at present invisible to other operating systems such as DOS, Windows 3.x, Windows NT, and Warp OS/2. Upgrades will be available next year.

Option "Boot to a Previous Version of DOS" (F4) is now disabled in Windows 95, even if a user installs only old FAT-16 disk partitions. System Commander and other 3-d party utilities could be used instead, provided user installed a FAT-16 primary partition as drive C.

The Advanced Power Management 1.2 services, which Microsoft has added to Service Release, include a Disk Spindown feature to reduce physical wear and tear on a hard drive, and a resume-on-ring power-management feature for 32-bit PC Card modems.

## Microsoft will support Kerberos security architecture in Windows NT 5.0, due in beta in the first half of 1997.

Kerberos is a "secret key" technology that uses a server to hold all the keys. Users gain access to resources using a specific Kerberos password that authenticates users by comparing the password to a corresponding key.

There is now a draft to extend Kerberos to public-key schemes. Benefits of the method include the ability to enable a user to log a Kerberos network using a digital certificate. This could solve one of the problems with public-key: that private key is tied to a single PC. Using extensions to Kerberos will enable a user to log in to a network from any PC on the intranet by entering password and have the Kerberos server pass back a private key for use during the session.

While Microsoft supports the merging of Kerberos and public key, security in NT 5.0 will be based solely on Kerberos.

Administrators can provide public-key authentication by mapping public-key certificates to user Ids in NT 5.0 new directory service.

## Phoenix BIOS version 4, release 6 adds high-capacity floppy support and support of NT 4.0 on notebooks…

- The BIOS update includes following key features:

- Desktop Management Interface (DMI) 2.0 which is "instant on" technology like in TV
- SIMM remapping on error detection. (if error-correcting code will detect and error, the system will continue work operating in less memory);
- Support of Self-Monitoring Analytical and Repair Technologies
- Boor from high-capacity floppies
- Several NT related changes:
  - Support for hot docking of peripherals under NT;
  - Power Panel for NT 4.0 (provide support for power management in NT)
  - Phoenix Card Executive (PC Card support for NT)

## Security alert: new file formats in all Office 97 applications …

Word, Access, Excel and PowerPoint will all have new formats in Office 97 to support a variety of new data types and technologies. The changes were necessary to support the graphics from the new Office Art tool, VBA and hyperlinks in documents. PowerPoint will be able to compress files automatically when it saves them.

That means that macro virus scanners will not be able to disinfect the macro viruses in MS Word 8.0 and Excel documents written in a new format, although a simple scanner that does not analyze structure of MS Word documents will be able detect them.

There will be a possibility to set default file formats, and it could be old format, so this step would be reasonable in deployment of the package in BASF corporate environment. This default setting can be done by LAN support personnel during a rollout to provide consistency across a company.

Office 97 also has been redesigned to handle unfamiliar file formats better. Administrators now can add pointers to remote libraries of file converters. Then, if Office encounters an unfamiliar file type, it can check the library for a converter. These libraries can reside on servers or on Internet sites. Microsoft plans to release Office 97 in December.

# MASS STORAGE AND BACKUP

## Reasonably priced 3.5-inch drives for backup in 7G range are available. Quantum will ship BigFoot 6.4G drive in Jan.97

Quantum Corp. this week announced Fireball ST, a 3.5-inch Ultra ATA drive with 6.4G bytes of capacity that will sell for $480, or 7 cents per megabyte. It offers an average seek time of 10 ms. It also will ship in December the 5.25-inch 6.4G bytes Bigfoot CY, with price $395. This drive is a good candidate for desktop backups.

Seagate Technology Inc. added two 3.5-inch hard drives to the Medalist line: the 3.2G-byte Medalist 3240 and the 4.3G-byte 4340. Average seek times 12 ms. Drives are expected to be available in Jan. 97

IBM's Storage Systems Division will release a 6G-byte hard drive 1st quarter of 97.

On the fast end Seagate will ship in the second quarter of 1997 4.55G and 9.1G drive with rotational speed 10,000-rpm. It will offer sustained rate of up to 13M per second (http://www.seagate.com).

## SyQuest will compete with Iomega in 1G removable drive solutions…

SyQuest Technology Inc., will announce the 1.3G-byte SyJet removable cartridge hard drive later this month or early next month. The external model is priced at $499, and the internal model is $399. Additional 1.3G-byte cartridges will be priced at $99.

## Swan is the third major vendor that will ship 130M floppy drive…

Much like LS-120 drives they will be compatible with 1.44M floppies. Price will be below $100. With new BIOS upgrades drive could be made bootable. In 1997 they will be bundled by major PC vendors instead of old 3.5" floppy drives.

## 12,14 and 16x CD ROM drives are expected in 1997…

All major manufactures will start production of 12x drives near year end. So prices of 6x, 8x and 10x drives will substantially drop. At the end of the year 8x are expected to cost $60-$80 and 6x $40-$60.

# ENCRYPTION PRODUCTS

## Atalla plans to bring hardware-encryption technology into the Intranets

Atalla Corp.(San Jose, California) is a little-known but well-established encryption provider. It produces mainly hardware encryption products. This year will debut a hardware/software server that will generate and support digital certificates and process SET (Secure Electronic Transactions)-based payments. In a partnership with VLSI Technology Atalla will produce PCI plugin boards that can be added to any NT server to include SET and certificate services.

While the majority of encryption technology can be done in software the process of encrypting and decrypting is CPU intensive especially on server side where volume of transactions much more than on workstations.

# PUBLICATION AND REPORTS

## CSI has published new Internet security manual

The Computer Security Institute has published an Internet security manual that addresses issues related to the array of attacks on computer data-many of which were spawned by the rise of the Internet.

Although most LAN support personnel are at least vaguely aware of the risks posed by the Internet, many have not addressed those issues because they don't fully understand the ways their system can be attacked or the methods that can be used to prevent attack.

Major types of attacks include:

- denial of service attacks,
- viruses,
- system break-ins,
- equipment theft,
- interception of network traffic.

The book, the latest in a 10-book series that includes manuals on such issues as E-mail, system and network security, and Internet security, is written by Dorothy Denning, a professor at Georgetown University. It is available to CSI members for free. Nonmembers can order the single publication for $10 and the entire set of 10 books for $50.

# OTHER IMPORTANT NEWS

## Compaq will not install Windows NT on its servers…

A user will need to purchase the license for NT and install at his/her own risk. This move is connected with high support costs, and Compaq is no longer willing to subsidize Microsoft.

Also, there are rumors about data corruption in large databases under high load on NT. For this reason, Dell is rumored to be considering not installing NT as well, but no official decision has been made.