Microsoft Small Business Accounting & Quickbooks

I just received my copy of Microsoft Small Business Accounting 2008, I've been wanting to try this out since I had the 2007 version, but I was unable to import the data from Quickbooks 2006 Pro. When I installed Small Business Accounting I started the import and low and behold I did not have to enter my Quickbooks password. This struck me as very odd and made me concerned, being out of time, I tabled further investigations until today. I created a dummy company, in Quickbooks, "Hackme" added a few quick entries, and proceeded to try to import it into Small Business Accounting.

When I tried to import he new company file it prompted me to open the file and allow access to Small Business Accounting. At which time I stopped feeling a bit better, but that feeling did not last long. I got to thinking, I remembered allowing access to Small Business Accounting several months back. My Quickbooks file has been vulnerable to theft, my customer data, names, address and phone numbers have been more or less easy pickings. The only positives as I see it is I do not store my bank accounts in Quickbooks, only a description of the account and I do not store Credit card data.

I'm doing a bit more research into how this can be avoided, mitigated, and or cleared after access has been granted. I certainly do not want my Quickbooks files being vulnerable to being sucked out by other people using Small Business Accounting or any other "authorized program".

I take some of the blame for allowing a program access to my data with out fully understanding what it does, but I also blame Microsoft & Intuit for not having the data link secured in a more robust manner. I am not sure if this "authorized link" can be exploited only on the machine it was initiated or if any Quickbooks file can be compromised after Small Business Accounting has been granted access, I have some tests under way, and will post the data when it becomes available.

Until then take this as a lesson learned, and do not allow programs access to your data, unless you know a few things:
1. How to revoke access to the program
2. What the program is actually going to do with the data
3. What type of data you are potentially exposing to the world
4. If the risk is worth the potential pay off.

-- Tim Krabec
Kracomp.com

Hit Man Spam

Spam has evolved over the years. By now most of us are familiar with the Nigerian Email scams of some one needing to funnel several "miloins of doll ares" out of their country, and give you a percentage, just by letting them use your bank account. On Monday Martin McKeay blogged about a Spam scam on being Sued by the Federal government. Now today I see an article in the local paper about a person being targeted by a hit man via email. Tcpalm.com reports A local Jensen Beach claims he being sought hitman. Something needs to be done to help educate people on spam, and scams in general.

The major difference I have seen between scams and online scams seems to be the amount of scams online, the number of people that can be targeted at once, and the emergence of scams that have more or less been squashed in real life.

-- Tim Krabec
Kracomp.com

Failing to Plan is not Planning to Fail

The topic of planning has come up recently in some of the podcasts, that I listen to,
http://www.securitycatalyst.com/ and http://www.mckeay.net/ There are basic options when it comes to planning:
1 Fail to Plan, Wing it and hope things go well.
2 Plan to Fail, Plan knowing things will go wrong, while trying to come up with where and when they can fail.

When failing to plan you need to have people who can react to a situation rationally, have lots of experience. Then depending on the type and severity of the failure you can make it out of the problem relatively unscathed. I speculate that we do not even notice failures, they just manifest them selves as slowdowns to the project.

While planning to fail, in contrast means that you realize that failure can and probably will occur, but during you meeting(s) you try to mitigate the affects of failure. The act of planning causes you to think about the project and can help you to work in the group. Even if nothing in your plan or contingency is used, you have at least though about the project and have more open communication with the group.

-- Tim Krabec
Kracomp.com

Support Networks

Sunday night, just as bath time was finishing up, one of our children slipped and busted his chin on the tub. After some 1st aid, the decision was made to go to the hospital for stitches. We made one phone call to a member of our support network and about 20 minutes later our support had arrived, a grandmother.

While this was a family emergency I got to thinking about how blessed we are to have a good local support network, I got to thinking about my computer support network. What happens if I get multiple emergency calls at the same time? Where do I turn if I'm out of ideas? Who do I talk to about the latest threats, the latest projects, new ideas?

If you do not have a network, start building one. Your local chapters of ISSA, Infragard, ASIS, a 2600 meeting group, SecurityCatalysts.org, technibble.com, league of professional system administartors.org, citysec.org, technical IRC channels, a local LUG, a SAGE chapter, a local computer club. I highly recommend working on an nurturing a support network, there is nothing like being owed a favor or 2 when you really need it. Earning favors is easy, just share your experience. If the groups are local join, give of your time, a few hours here and there can really add up. Share how you manage your updates, talk about scripts you've written to handle this or that, ask questions about how some one else accomplished another feat.

-- Tim Krabec
Kracomp.com

G-Archiver, it's been nearly a month, what is thy status?

Nearly a month ago a story broke about g-archiver, a program to back up your Gmail emails. I wrote about it here. There was a piece of "debug" code left in the author(s) suggested it was an innocent mistake and it would be corrected quickly (here). But nearly a month later there is still no patch, no fix, and it appears no further response from the author(s). Shortly after the story broke I searched for different versions of the software, and all I could find was only the 1 version. At this point I'm going to assume that the author(s) were not serious about the product and more or less released a totally immature product written for personal use, or don't really care about the people using their product.

-- Tim Krabec