Continued Configuration Changes on Windows Legacy Servers

Update: We will be doing a planned reboot of the Windows servers late this afternoon Wednesday January 21, 2014 to begin the process of restoring two of the remaining clients that are still offline.

Scope: This update applies to Tendenci 4 clients on Windows only. It specifically does NOT apply to Tendenci 5 or Tendenci 6 clients on Linux.

To give you an idea of the scope and velocity of hack attacks that continue, these are attempted crimes mind you, I’ve attached a 15 second video taken several days ago of actual attacks on one of our servers INSIDE the allowed ports.

15 seconds of network attacks

A further update on the 404 errors that the legacy Tendenci 4 clients have been experiencing intermittently. We have been measuring everything possible and tweaking the configuration settings as we see patterns in the logs. Each day generates over 1GB in security alerts across the data centers. All of these are either known attacks, or zero day attempts.

This is what we are fighting and it is relentless. The fact remains that we have protected the legacy sites by moving them from Windows 2003R2 IIS 6 to Windows 2012R2 IIS 8. But to make ASP classic run in IIS 8 we are running the servers in “compatibility mode” which is not an ideal configuration for any technology. And “secure” does not mean “functional” if your sites locked down to the point of not meeting functional requirements.

We have taken a step back and concluded that a technology platform started in 2001 is not up for the cyberwars of 2015. We will have a further update posted later today on possible paths forward for Tendenci 4 clients.

~ Ed

HOWTO: Keep your cell phone safe and secure

Cell phone user thanks to Gwenflickr

Time to put the smart in smart phone!

With news updates of phone hacking scandals splashing headlines the world over, we’re hearing lots of cell phone security buzz – and for good reason too!

While a major news outlet may not be interested in your cell phone activities (or we sure hope not!), this is still a great time to make sure you are practicing some solid cell phone security practices.

Keep that cell phone close by!

You are far more likely to misplace / lose a cell phone than to get hacked, so be sure your little handheld buddy doesn’t stray too far.

  • Beware of keeping your phone on your table at busy restaurants, leaving your phone in the car (even just for a ‘second’), etc.
  • Find a ‘funky’ cover or skin to make it super easy to identify your iPhone – avoid an accidental mix up easily (I’m a big fan of the Infectious skins) when at a networking event or dinner with 7,000 other iPhone / Blackberry / Android users
  • Password protect your phone to keep your logins, contacts, email and notes safe from undesirables – also great for making sure any kiddos in your life don’t make random calls to Japan
    • For safety purposes, use an emergency app like smart-ICE to not only store your ICE info (‘In Case of Emergency’) for paramedics to be aware of medical conditions, insurance details and contact info, but add ICE info to your locked screen (in addition to your quirky-cool smart phone wall paper).
  • Install a phone location / security app on your phone, a few examples:

Beware of public Wifi + ‘Evil Twins’

Yay for public Internet access!   But boo for public Wi-Fi security.   Extra emphasis on that ‘boo’ when using a credit card or login, as not all Wi-Fi connections are as secure and innocent as they seem.   Learn more about the ‘Evil Twin’ phishing scam here.

As cumbersome and slow as it might be, opt for your 3G / 4G network connection over a public Wi-Fi connection to stay secure.   Or pick up your own piece of the Internet and invest in a MiFi card.

What’s up with hardware and software security?

Not all apps and phones are created equal.   As an iPhone user, Apple has a more stringent vetting process of apps that helps weed out *most* malicious programs.   Android’s app community is far more open and has had some security exploits in early 2011.

Use common sense when purchasing apps and accessing certain sites (like your bank account, for instance) on your smart phone.   Beware of ‘look alike’ apps that might be masquerading as a Chase banking utility and think twice about depositing checks using a phone app – and learn the safe ways to bank on your phone here..

Photo thanks to Flickr user GwenFlickr

Get increased Facebook security with HTTPS

Add extra Facebook security

Ah, the Internet.   Home of silly company names and weird acronyms for cool stuff.   Gowalla, anyone?

The latest focus in online verbiage that you should really know about is:   HTTPS (‘hypertext transfer protocol, with SSL security)

Facebook has recently added HTTPS support, which means that you now have the ability to access the Facebook site in a more secure environment.

How to update your Facebook HTTPS settings

  1. Visit your ‘Account Settings’ page:

    Update Facebook account settings

  2. Scroll to Account Security and click ‘Browse Facebook on a secure connection (HTTPS) whenever possible’:
  3. Don’t see this option yet? Hold on for a bit, as they are rolling it out over the next couple of weeks.

How will HTTPS affect my Facebook-ing?

The Facebook programmers have cautioned users that enabling this additional encryption may cause pages to load more slowly and also means that some 3rd party applications may not work until some additional tweaking is done.

What?   Facebook has been insecure this whole time?

Wellllll…   that’s a tricky question to answer.   This increase in encryption with HTTPS makes it that much harder to access your Facebook when you are, say, surfing on a public wifi connection.

But, as we’ve seen with numerous Facebook updates that have exposed information users didn’t intend to share publicly, approaching your Facebook surfing and sharing with caution is ALWAYS highly recommended.

Feeling overwhelmed or want a friendly person to friend on Facebook?   Contact the Schipulites to see how we can help!

Photo thanks to Flickr user Sean McGrath

WikiLeaks and “Cablegate” Explained

If you’ve been paying attention to the news even a little bit this week, you’ve probably heard a lot about WikiLeaks. It’s tough to cut through the spin and get to the facts, so don’t worry if it’s all left you a little confused. To help you out, we’ve put together a few FAQ’s about WikiLeaks, “Cablegate,” and the security issues surrounding this latest news.

  • What is WikiLeaks?

WikiLeaks is a non-profit media organization that “publishes and comments on leaked documents alleging government and corporate misconduct.” Their slogan is “We open governments.” The site has leaked many documents incriminating both public officials and private businesses since its founding in 2006. Contrary to its name, WikiLeaks is not a wiki — content on the site is not editable or commentable by visitors.

  • Why are people talking about WikiLeaks right now?

A few days ago, WikiLeaks began publishing the first of over 250,000 diplomatic cables between the U.S. government and embassies around the world. The documents range in security level from unclassified to secret (a level up from “confidential”). The U.S. government is not too thrilled that all this behind-the-scenes talk has been made public, and some foreign leaders are not too thrilled about what they’re reading.

  • How did WikiLeaks get these documents?

Well, they were leaked. Bradley Manning, the U.S. Army intelligence analyst who (allegedly) supplied the documents to WikiLeaks, is currently imprisoned in Virginia awaiting trial for charges of unauthorized use and disclosure of classified information. There is, of course, a Free Bradley Manning movement, which WikiLeaks has been involved in despite refusing to name him as the source of these documents or other leaks he is suspected of.

  • What’s in them?

A lot, including evidence that Secretary of State Hillary Clinton and former Secretary of State Condoleezza Rice both instructed U.S. diplomatic officials to engage in espionage at the United Nations (which, by the way, is forbidden) and some not-so-great things said about foreign leaders.

  • Where can I read the cables myself?

Several news publications also published the documents, and you can follow the coverage via the New York Times or search the raw documents yourself via The Guardian. Der Spiegel has also put together an interactive map of the cables organized by their level of secrecy.

  • Why can’t I get to WikiLeaks.org?


The site has been hit by several DDoS attacks since publishing the cables. A “lone hacker” has taken credit for the attacks, but the validity of his claim is questionable. You can follow WikiLeaks on Twitter @wikileaks for the latest updates.

  • What does it all mean?

Will Hillary Clinton resign? What will happen to Bradley Manning? Not sure. The more thoughtful questions that this leak and much of WikiLeaks’ history bring up are about trust in government, security, and confidentiality. Governments and the people who work for them haven’t changed much, but technology definitely has. Whether you believe in absolutely open government like WikiLeaks founder Julian Assange or you’re more likely to call Bradley Manning a criminal than a hero, it’s difficult to ignore the power that technology gives to passion. Bradley Manning and Julian Assange were both willing to take huge risks, using technology as a tool, for something they believe in, and they’ve got a lot of people talking and thinking about new ideas and questions as a result.

Photo used under a Creative Commons license from Flickr user opensourceway.

Learn About Bullying at the Children’s Museum

If your a parent getting ready to send your kids back to school, the Children’s Museum is hosting a free 3-day boot camp dedicated to educating kids and adults about bullying. Anti-bullying training sessions will be held during the day, and local law enforcement and internet experts will teach parents valuable computer safety skills. While the event is free it’s import to register at the museum in order to ensure placement, spots are going fast! You can register for the August 12-14 sessions by picking up passes at the Children’s Museum from noon until 4 p.m. on Saturday, Aug. 7 or Sunday, Aug. 8th. You can find more information at KPRC Local 2.

Server Maintenance Underway – Minor Outages May Occur Tonight (June 6th).

ServersTonight our team will be doing some server diagnostics to keep our servers running smoothly. We take our job of keeping your website fast, secure, and happy and this will allow us to do just that.

You may possibly experience some minor and temporary website disruptions around 6:00 PM CST, but these will quickly pass. We appreciate you business and look forward to many smooth and safe years of Web marketing your organization!

If you have any questions please call our support line at (281) 497-6567 EXT. 411 or email us at support@tendenci.com

Thanks from the Schipul team!

We’re Giving Our Servers Some Love – Minor Outages Tonight (June 6th) May Occur

Our team is doing some server maintenance today in order to keep our servers running at their best. We love (and take very seriously) our job of keeping your web sites secure fast and happy and this will keep us doing just that,

You may experience some minor website disruptions around 6:00 PM CST, but these will only be temporary. We appreciate your business and look forward to many smooth and safe years of Web marketing your organization!

If you have any questions please call our support line at (281) 497-6567 EXT. 411 or email us at support@tendenci.com.

Thank you!