
Hello folks, allow me to introduce myself - my name is Jim and I'm a support tech with AppRiver, LLC. In addition to our Hosted Exchange services, I also support CommuniGate POP email, AppRiver's very own SecureTide spam protection, CipherPost (our email encryption for Outlook service), MS Outlook (2003, 2007, and beyond!), Mac Mail, Entourage, inbound/outbound mail delivery issues, BlackBerry, iPhone, Droid, et. al., various DNS crises, chat console support, ticket support, global warming initiatives, ridding the world of beer one drop at a time, etc.
I guess I'm what you would call "the first line of defense", along with my fellow trench-mates for just about everything technological you could imagine. When customers need assistance, they call us. One customer recently phoned because she couldn't access Home Depot's website. Hey, it happens, and so what's one to do? After a little DNS cache flush, she was all set! Although outside the normal scope of profession, I was happy to help.
Some of you reading this might say, "Why on Earth would AppRiver waste time and resources on something not remotely related to its products?" Well, it's what we do. We go the extra mile to make sure our customers are happy. It's what separates us from the rest.
I'm hoping you'll stop by this blog every now and then, when you have some time. The funny thing about Exchange Hosting is pinpointing the starting point since there are so many things to cover. I suspect it may be hard finding a topic at first, but once the floodgates open, all things Exchange will be blogged!
So, and in closing, a little bit about myself: I've worked for some pretty prestigious outfits before, both private and as a government contractor. I've supported big-shot corporate attorneys, doctors, generals, rocket scientists (honestly - you should've seen their faces when I said, "look guys this isn't rocket science"), executives, and media celebrities, among many customers. I came aboard AppRiver in December 2008, and I'm extremely proud to be a part of what I believe is the finest organization in the industry. I'm currently the platoon sergeant in my trench of three Appers, whom I'm proud to serve with. One colleague jumped on a live Blackberry, saving the rest of us. That's teamwork, folks. Finally, I bleed Chicago Blackhawk red, and Chicago Bear blue.
Thanks for stopping by and I hope to see you here again soon for another episode of "Tales from the Trenches".
Vodafone, a UK based telecommunications company has recently been discovered to be shipping their version of the new HTC Magic smart phone with off-the-shelf malware built right in. HTC phones are in direct competition with Apple's iPhone, and they run on an open source platform known as Android. It is unclear at what point the malware ended up on the phone, but it is clear how it behaves. Once the HTC Magic is connected to a computer via USB cable, an autorun.inf file begins to silently load the virus onto the newly connected host machine. The malware then opens a backdoor and begins communicating with the Mariposa botnet. This botnet has been big in the news lately as three men have been arrested by Spanish police for their involvement in running the botnet. A fourth is still being pursued and is believed to be in South America. This botnet has been involved in attacking thousands of businesses and enterprises including at least 1000 Fortune 500 companies tasked with stealing banking credentials and personal information from the infected computers. The botnet was comprised of about 12.7 million machines, one of the biggest to date. According to Panda Labs, Mariposa wasn't the only malware that was installed by the phones. They also contained a remaining strain of Conficker and a Lineage password stealing piece of malware as well. Currently it doesn't appear that Vodafone has offered any sort of press release on the matter.
A new incarnation of ransomware has started to reek a bit of havoc in the former Soviet Union as of late. This form of an old classic is proving to be especially troublesome as it is targeting casual home users. Once the malware is on a host machine, it locks it down completely and instructs users to text a premium SMS number in order to receive a code to unlock it. The price of the text message is about $15 dollars. This attack is made possible by the fact that the premium SMS industry in many countries is very poorly regulated and it is completely possible for a person to register one of these numbers completely anonymously thereby thwarting what seems like an easy trackdown. The original infection can occur in a number of ways, by visiting a malicious website, or by executing a Trojan that may have been obtained through filesharing, etc. the attackers are trying not to leave any stone unturned. The telecommunications industries in countries such as the US, the UK, Australia, and New Zealand do have stronger regulations where setting up a service such as this would not be possible in an anonymous fashion, however this doesn’t prevent the attackers from using numbers set up in these poorly regulated countries in a possible domestic attack sometime in the future.
SEO or Search Engine Optimization attacks are nothing new, but the frequency of this type of attack has increased rather rapidly. SEO poisoning usually happens when an attacker inserts common search terms in iframes along with scripts that send victims to malicious sites where they become infected. When a large event occurs in the news hackers waste no time to begin compromising related web pages with these hidden iframes. It is not uncommon most recently during peak times after a breaking story comes out for nine out of the top ten search results to be malicious web pages. The trick is to flood these malicious pages with terms that people will likely be searching for in order to raise the popularity of the pages and have them appear higher up in search results. This is a common marketing strategy whose technique has been bastardized by the bad guys. Some of the most recent real life events that have spurred these SEO Poisoning attacks have been: The earthquake in Haiti, The Olympics, and then the Olympic luger who died in practice, Mardi Gras, and most recently the disgruntled software engineer who flew his plane into the Austin Texas IRS building.


I've written about a similar type of underground industry called the pay per click or PPC in the past 







In an apparent response to cyber attacks against Google and Gmail users, Google has decided to pull out of China. The search giant claims in an 






