At some time, on November 14, 2011, Intuit performed system maintenance across their online-service systems. And then something went horribly wrong. The systems didn’t work as they were supposed to. Online invoicing stopped working, as did their merchant-services payment processing system. Intuit quickly responded via Twitter and their Facebook page, telling everyone that they were aware of the problem, and that they were working on it. At some time between 8:00 & 9:00 PM (EST) that night, they updated their pages as follows:

“QuickBooks Online is back up and running. We apologize for today’s service disruptions and for letting you down. Improving service reliability is a top company priority right now.”

But this morning, things were still not working properly. As of this writing, it’s still not working. At about 11:00 AM (EST), they posted this follow up message:

As part of our efforts to improve service and increase uptime, we did maintenance work over the weekend which caused issues with several of our systems on Monday, November 14. We are experiencing the same issues today and in order to fix it have decided to take QuickBooks Online, QuickBooks Online Payroll, QuickBooks Connected Services, QuickBooks payments processing, GoPayment and all other payment processing services offline until at least 12:00 p.m. PST. No data has been lost. More info: http://bit.ly/tx620f

We’ll have to wait and see.

Now, for me, this is largely an inconvenience. It’s not hugely disruptive of my business efforts. But there are folks out there who use these services for their day-to-day operations. People who have stores that take credit cards are the ones who have been hit hardest. Imagine having to explain to your customers that you can’t take their payment right now. There’s talk of a class-action suit, which I could easily see happening. The natives are not just getting restless, they’re getting mutinous.

Businesses often have to perform maintenance or updates on mission-critical systems. These are typically scheduled during off-hours, so as to minimize impact on their customers. And Intuit did that. But for a mission-critical system, you typically try to have backups; possibly even backups to the backups, so that in the event that something goes horribly wrong, you can get something back into place, quickly, in order to minimize the impact on the users. This, it would seem, Intuit did not do – at least not very well.

This leads me to one of two conclusions:

1. They didn’t do their jobs properly.
2. They don’t consider these online systems as “mission-critical.”

If it’s the latter, that’s a major problem. Their customers are small businesses, and these systems, while perhaps not entirely mission-critical to Intuit, are definitely so for their customers! Under normal circumstances, my reaction would be something along the lines of, “If they aren’t that concerned for our business, maybe they shouldn’t have it.”

The problem, in this case, is one of monopoly. Intuit enjoys a fairly monopolistic hold on the small business financial software market. There is simply no other product out there that does the job QuickBooks does, with as much flexibility and power, and for as low a cost. There are many competitive products out there, mind you, but QuickBooks is the standard to which they are all measured, and there aren’t many that measure up very well, especially for the price. In the U.S., some 95%+ of small businesses use QuickBooks. So they’ve got us small business people essentially over a barrel.

Products like FreshBooks are great for some simple needs, but not nearly as powerful. And products like Peach Tree have a lot of power, but you really need to understand the underlying accounting principles to use it. And most small-business accountants out there love the ability to just take a copy (or Accountant’s Copy) of the file, and work with it on their own, without messing up anything live. Where are you going to find that sort of functionality and presence?

So we’re pretty much stuck. Any thoughts?

An article I read today on HuffingtonPost.com, talked about security researcher, Jay Radcliffe’s, recent experimentation on his own insulin pump and blood-sugar monitor. He discussed his findings in his Black Hat conference briefing. Basically, he found that these devices, and presumably others, could be compromised by their wireless capabilities. It could be possible to cause a monitor to display incorrect readings, or a pump to distribute insulin inappropriately.

“Everybody’s pushing the technology to do more and more and more, and like any technology that’s pushed like that, security is an afterthought,” Radcliffe said.

And that’s the problem: Increasing technological capabilities, with Security as an afterthought.

We’ve been doing this technology thing for awhile now. We know there are risks. We know there are people who want to circumvent or break systems, for a variety of reasons. Anything with any kind of connectivity must have Security as part of the original design plans; not something you try to patch later.

This week we heard of two virus-attacks against Macs, out in the wild. But wait… Is that really possible? I thought Macs were immune to viruses!

Sorry folks, they’re not. Never were. The problem is that a lot of people don’t seem to really understand what viruses are, and what makes a computer vulnerable to them.

Basically, a virus is a program written by a person (they don’t just grow by themselves), for the purpose of attacking specific types of machines. Remember the Stuxnet virus that made the news in July 2010? That was designed to attack a specific Siemens industrial process control system, which was being used by Iran in their efforts to create nuclear weapons. That’s how specific viruses can be.

So why haven’t we seem them very often on Macs? My thought is that there are two primary reasons:

1. Thusfar, the Mac platform has simply not been considered worth attacking because of Apple’s relative marketshare to Windows. Although recently, Apple has had tremendous increases in marketshare, there are still many more Windows machines than Macs out there. If you were going to write a virus to, say, steal credit card numbers from consumers, would you rather spend your efforts on systems with more users, or with relatively fewer users? More PCs (and frankly, more less-educated users) means more targets, and that means more compromised machines. (There are even fewer viruses out there that attack Linux systems, for the same reason.)
2. Windows XP and earlier had a lot of security vulnerabilities. A lot more than Vista and Windows 7. So the operating systems were easier to exploit. And the vast majority of Windows machines still out there (at least as of this article) run Windows XP.

Given those two reasons: More opportunity, and easier to break – it makes sense that most viruses were written to attack Windows systems. But as Apple systems gain more market traction, they become much more attractive to malware writers. The fact that Mac users are not used to using anti-virus software can potentially make it worse. And the fact that Mac users have never had to worry about dirty social-engineering tricks that Windows users have had for years – like the ones used by the most recent attacks – can potentially cause this to become very bad, very quickly.

So Mac users – don’t be so confident that you don’t need antivirus software, and start being vigilant about where you go, and what you allow to install on your machines. This is only going to increase.

Since my last post about the Windows UAC function, and how it can give you early warnings about possible malware infections, I’ve had a number of people ask me for more information about the infections work. How do they get past your AV software?

AV Can Only Do So Much

The first thing to realize is that traditional anti-virus software has limitations. It can only find malware once it’s on your machine. And by then, much of the time, it’s too late.

Microsoft released a Critical patch today for pretty much all versions of Windows, from XP on up. (This doesn’t mean it doesn’t also apply to earlier versions; just that earlier versions are no longer supported.)

The issue behind this patch lies in that when you create a shortcut for something, Windows actually reads part of the underlying file to pick up things like the icon to use for the shortcut. Well, they’ve found a problem in the way that this works, and that very process of displaying the icon can be exploited, enabling code of the attacker’s choosing to run, with the privileges of the locally logged-on user.

In other words, you don’t even have to run the program, in order to be attacked. All they have to do is make an icon appear on your desktop, and when Windows reads the file to display the icon for it, it will run the malicious code with your permissions. Since many people use Windows XP with Administrator permissions, this means they own your system. And since many people with Vista or Windows 7 routinely ignore (or even turn off) the UAC warnings, they’re going to to own them too.

If your system is set for automatic updates, you’ll have already applied this patch this morning. If not, do! It’s a Critical level security patch, and it will likely require a system reboot – it did for me.

It’s true… Once again, those security guru’s at FaceBook have decided that your privacy isn’t all that important. At least, not important enough to do something novel like… ask your permission before divulging your personal information!

This time, it’s your phone numbers. Recent changes now have the defaults set to show your phone numbers to your Friends only. I guess I can hear the logic on it: If they’re my friends, then maybe it’s okay for them to have my phone numbers. Unfortunately, that’s not in line with the way most people actually use FaceBook. They have business acquaintances, the guy they met at that last trade show, people they knew back in kindergarten who may have grown up to be axe murderers (you never know…), etc. Come on people – we’ve all done that. And we’re generally okay with them seeing our bizarre thoughts, but do we really want them all calling us?! I think not!

Nonetheless, they are out there, available. If you want to get an idea as to the scope of this, try this:

• Log into your FaceBook account.
• On the top right of the screen, click Account, and then Edit Friends.
• On the left side of the screen, click Phonebook.

Take a look at all your friends, and their phone numbers!

Now if you don’t want your numbers to be displayed like that, here’s what you gotta do:

• Click Account, and then Privacy Settings
• Select Custom, and then click Customize Settings link, on the lower left of the chart.
• Scroll down to the Contact Information section, and then set the appropriate items to Only Me.

In England, this past week, Rory Cellan-Jones, reporter with the BBC, reported about a “scientist”, Dr. Mark Gasson, who implanted himself with a computer virus. Apparently, this was supposed to be an “ooh, aah” sort of thing. Revolutionary and whatnot. It wasn’t, but more on that later.

The response to the article was apparently (and I believe correctly) largely derisive, to the point where yesterday, Mr. Cellan-Jones published a follow-up article. In it, he admits that he “should have adopted a more sceptical tone” in his original piece, but then attempts to justify it anyway. He also contacted Dr. Gasson for a reply to some of the criticism. Dr. Gasson responded that he wanted to bring attention to the need to consider security in medical technology devices.

Now, I agree that security absolutely must be considered as we begin to move towards electronic devices being used as body parts. It would be terrible if, for example, unsecured wireless technology was used to connect the brain to an artificial arm, and someone hacked it and made it beat its owner to death. But Dr. Gasson’s experiment isn’t anything like that.

What Dr. Gasson did was take some “virus code”, put it on an RFID chip, and implant it under his skin. The code was designed to redirect a web browser to a malware site. Dr. Gasson is not a web browser, at least not in the technical sense. And the chip doesn’t have the mechanics necessary to make him do anything. It was no more impressive than if he stuck it in his pocket. This “experiment” is sort of analogous to sticking dirt up your nose to see if it will give you a dirty mind. At best, this was more a political point than a science experiment. At worst, it was simple publicity seeking.