Skip to content

User Experience Monitoring

Advanced tasks: user experience monitoring

In the last century we had very primitive computers and now, at the dawn of a new millennium are we the users who have become primitive !? Want to learn more? Let’s get to know User Experience Monitoring

My first computer, in 1987, was a laptop with a monochrome LCD screen and 16 kilobytes of program memory. They were 15,584 precious bytes and they were read and executed very quickly. When I started to study engineering, it was the turn for that noble artifact to perform approximate integrals and, bam! This is where user experience comes in, when the professor asked me to compare his final result with that of the computer.

Sometimes, depending on the complexity of the formula and the iterations requested, the teacher would finish before the computer. That is why I had to choose those parameters well before starting the calculation, just based on estimation. A decade later, GNU/Linux already existed, the Internet boom began (which has not stopped to this day) and we began to connect by applications that allow us to have a terminal window and thus leave workload calculation to servers dedicated to it.

The experienced user

What we were clear about was that computing power was needed. Decades had gone by where it was delegated to remote terminals and/or dumb terminals and the entire workload was done on a “supercomputer.” Sir Tim Berners-Lee created, de facto, HTML and web pages were like static board ads, changing from time to time. Something called Common Gateway Interface (CGI) was invented to allow them some dynamism. This is how we began to worry about the time it took to solve calculations and results and then present them in a web page template.

Databases evolved: I used MS Access® for small applications and for everything else dBase® and Clipper®. Then Visual Fox Pro® came, with which I was able to handle tens of millions of records on a personal computer.

It was inevitable that databases would pass by without impacting our lives. Later, in this century, PHP language was responsible not only for creating web pages, their HTML code, but we could also custom generate, in several versions, according to different parameters, connecting directly to databases and retrieving data for users in real time.

Brief retrospective

By the beginning of this century, Pandora FMS was born (in 2004, to be precise) and the checking and loading time of a web page, its HTML component, is part of what I consider primitive monitoring. It even has some advanced components, such as text search on the web page or simple login, like the POST type, to take the time it takes to return a result, among other Modules.For Pandora FMS, each measure is called a Module, which are grouped by Agents.

Meanwhile, desktop applications, now known as on premise, were also evolving. In said applications, all their binary code relies on the device where they are executed, and the data is either obtained from a local file or is connected to a database to obtain and edit information, more useful and widely used. They are also known as native applications of each operating system in particular.

Pandora FMS can do remote database checks and we can add operations that a user would generally do. For example, ask for the last seven days of sales, -if the database is online- how long it takes to return this result: if it takes X amount of seconds or more, return a warning on the screen or an alert by mail, SMS, and so on. This gives you a rough idea of the state and operation of a system, but it is not yet user experience monitoring.

Complex applications

As the computing power in servers has always been higher than in our homes or offices, the ingenuity of application programming interface, better known as API, was realized. An API is a set of functions, procedures, and subroutines that provides a “library” to be used by other software. Pandora FMS and many applications have this way of allowing third parties to develop their own interfaces to perform predefined tasks: create a new article in the database? Publish a price list? These tasks are candidates to be performed through an API.

But we are approaching user experience monitoring: if the application created by a third party goes slowly, where is the bottleneck?, in the application?, on the server?, in the communication of the server? Are there other causes for this delay?

Another detail to take into account is our human factor: I have personally had to be told that an application I have made “is going slow”. I took the source code, I changed the background color of the forms, I compiled, installed and received a variety of different responses: what got better, what got worse, etc. That is what is called qualitative reporting, but without figures or facts to support it.

Pandora FMS has real cases of experience monitoring where they reported quantitatively how and when process delays were detected. Thus we are already reaching the present, the applications that we use the most at the time of writing these lines.

Web applications

You can see how the Internet has changed the way we work to reach something that is practically ubiquitous today: web applications. Through a web browser, users are identified and everything is done online, whether the web application connects directly or, through API, to one or more databases.

They have the advantage of being able to quickly change forms for users, but it opens up other problems such as workload sharing between multiple servers and redundancy in data storage. For all this, Pandora FMS has excellent tools, and we can even add our own, that’s how flexible it is!

Said web applications can also be delegated to third parties, and if this is the case, Pandora FMS can monitor the service level agreements (Service Level Agreement or SLA): these scenarios are really complex and they may even need to include user experience monitoring.

Primitive Users

Thus, we have reached the great concern of our times: Is our computer powerful enough to run our favorite web browser? Because, actually, the vast majority only run a web browser and there they read their email, communicate through social networks, carry out their remote work during the pandemic, access their bank accounts, publish on their blog, keep spreadsheets online for different subjects…There are even dozens of tabs open, each one consuming processor and memory cycles by the web browser.

We have become rudimentary and elementary, even our web browser updates automatically. We can acquire a new computer and in a short time have everything working again as we had it since it is completely based on the web browser. I even have Mozilla Firefox and Google Chrome accounts that sync with my other devices like mobile phones and e-book readers: they offer this service to keep everything centralized.

With Pandora FMS and its Software Agent (small application installed in each device and that monitors locally) we can quickly know if these web browsers represent a very large workload for the device, as well as inventory of the software and hardware from all of them.

Have we been monitoring enough with this brief retrospective that I told you? This is where user experience monitoring comes in.

Experience monitoring

User experience monitoring is like simulating being a user who executes predefined monitoring tasks and whose results are carefully measured, saved and sent to the corresponding Pandora FMS server.

It was invented for all this that I explained you, both web applications and desktop applications.

To be honest, I’m not the first to write on this blog about user experience monitoring:

For web applications, Pandora Web Robot (PWR).
For desktop applications on MS Windows®: Pandora Desktop Robot (PDR).

Essentially, and in both cases, it is about moving and clicking with the mouse and/or pressing the keyboard for each of the application options to be monitored. If you want to know the details in depth, you should undoubtedly click on each of these two articles after finishing your reading here, since there is not much left to finish off.

Progressive web applications

Of course the world is constantly changing. Now web browsers, through the support of each operating system, offer progressive web applications that blur the boundaries between web applications and desktop applications.

They base their technology on HTML, CSS and JavaScript (which works as PHP but on the client side), which is no surprise to us who are used to web applications. The difference is that it uses background processes that are responsible for intercepting our requests to the domain where the web system server resides, but go further using the cache of the web browser. They do not need installation as we know it (if the user consents to its use) and can even make use of their own local databases such as SQLite, for example.

Here monitoring is somewhat complicated, since these progressive applications are capable of working offline with previously saved data: it will be a matter of programming requests with content of random values to avoid this behavior. We can also refine and target our Software Agents to refine our monitoring task. But all of that is enough material for another article.

Before finishing, remember Pandora FMS is a flexible monitoring software, capable of monitoring devices, infrastructures, applications, services and business processes.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Productivity porn, meet the new scourge of companies

Do you know what Productivity porn is? We tell you everything you need to know!

“Have we gone crazy yet?”, this is a question that comes to mind very often these days. Indeed speed and excess is what characterizes the present time we live in. Constant and pressing stimuli that lead to viral videos, fake news and extravagant coach appointments that lead nowhere. Vanity and emptiness are for sale, even when it comes to productivity tips. “Do you know Productivity porn?”, this is another question, not as conventional but as relevant as the previous one, at least if you have fallen into its disturbing clutches.

To this day, we know that if you have managed to get to work, already a milestone, you will do so for an average of at least 90,000 hours in your life. That’s about ten years of consecutive work. Discouraging but true. So it is normal that, aware of the subject, you try to make the most of the time you spend at work. However, our desire for it has gone so far and in such a macabre way that, as always, it has ended up taking its toll on us. That harmful addiction to productivity, productivity, productivity and productivity at work has been renamed “Productivity porn”. A more stale and abominable “porn” than the “porn” we are used to.

Some obvious characteristics and signs of the so-called Productivity porn:

  1. Productivity porn is often noted for its unrealistic demands, “If you want to achieve maximum productivity, get up at 5 in the morning and check out your entire mailbox, social networks and what the commercial postman brought before 6″ “Do you only have one planner? Go get several! In paperback as well as digital and online and fill them in with a succession of hours and perfectly delimited work blocks so that there is total evidence of the 15 minutes and 40 seconds of the rest for beer and tacos that you deserve once a week.”. Because Productivity porn is like that, consider that you are an indefatigable robot, perfectly designed to advance in your work and in your life or die in the exhausting attempt.
  2. Even less realistic results. One can fan that flame: “Do not be yourself, be the best version of yourself, be the TOP of yourself, Leonardo Da Vinci and Cristiano Ronaldo, together, of yourself.”. But what Productivity porn does is try to capture and brainwash you into being a completely different person than you really are. Changing your personality so that it is replaced by a computer program, and also promises you that this transformation will take place from one day to the next. Like the diets of the telemarketing.
  3.  There is always a guru. Perhaps this is the greatest of the signs that Productivity porn presents. A god among men, who floats above them radiating a halo of light and who expresses with all his being an aura of “Admire me, I know the way (for everything) in this life”. Many times you will recognize him for appearing in the ads of your favorite videos on YouTube, others for his pedantic demagogy. In any case, his physical and psychological attractiveness is one of the greatest assets of Productivity porn.

It is very true that, as experts in the field, they will have achieved results sometimes, but it is very naive on our part, and misleading on their part, to believe that there is a definitive recipe, that if it is followed carefully, it could work miracles, to turn any of us into a profitable machine and harvester of successes, with the results that we hope to achieve at our feet in the blink of an eye.

If you’ve ever come across any of these striking features, you’ve likely been in front of the toxic tóxico Productivity porn. I’m sure right now you would know how to identify it among other realistic and evidence-based productivity strategies. Cool, it is important to be aware that applying Productivity porn can be harmful.

But why do we fall prey to Productivity porn?

If it smells rancid a mile away, why the hell are these unrealistic productivity plans so appealing to us? I already told you, Productivity porn points directly to our little heart, to that part that likes to have illusions.

And it is that positive thinking is usually synonymous with productivity, but fantasizing and constantly having our heads in the clouds, with our unlikely desires, takes us out of the most palpable and decisive reality. We plunge into a whirlwind of fantasy, based on dreams instead of facts, and we end up setting goals that, at first, can never be achieved. Bad things for true productivity.

And, surely, Productivity porn and its presumptuous and unreal routines do not help. Both planning, and reading excessively on how to plan, is an obvious sign of procrastination, also typical of Productivity porn, which takes us away from what we really should be doing: focus and work on our purposes.

We need more confidence and performance and less to have the false sense of work that planning too far in advance and in the long term gives us.

Spending the afternoon watching videos on YouTube about how this diet is going to get rid of that belly is much more comfortable than going down to the street immediately to exercise. ¡Focus!

Product tips of the day

We have already seen what it is and why we fall into this nervous breakdown that is Productivity porn, now we better see some tips about real productivity. Something that helps you move forward and focus, but not like a locomotive with an inexhaustible battery, rather like a capable and persevering being who wants to make their day to day something useful.

  1. Accept your limitations.. The sooner you stop thinking of yourself as a Superman who endures and can do everything, the better. Consider yourself a Batman, he also has bad days and also gets tired of battling the Joker. Do not take your work home with you, do not corrupt your family life, love life, friendships or hobbies with it. You will come back with more enthusiasm if you leave your work apart from your private life.
  2. Avoid spending the day looking for tips and secret formulas to save time in your life or in your work, and guess what, you will save precious time in your life and in your work.
  3.  If you install a new productivity strategy in your routine, give it time to work. It needs that, perseverance, diligence and discipline to master it. Do not go crazy because at the very beginning you have not achieved a world productivity record, give yourself time.
  4.  When you know that something works, keep it and do not change it, at least without prior analysis, by another type of strategy that you have been promised works better. Go at your own pace and if it works, don’t mess it up. Better productivity in hand than two in the bush.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Firewall… It’s getting hot in here!

Do you already know what a web firewall is? Let us tell you about it.

There’s something that humans and machines have in common, and no, it’s not the disappointment suffered by the final season of Game of Thrones, or, well, at least not only that. What we have in common is that we need protection. You know, animals need it too, and plants, but if you’ve gotten this far, it seems that you’re interested in computers, networks and all these pretty modern “geek” things, so today we’ll talk about that kind of protection.

Just as you would protect your dog, your ficus or yourself, you have to protect your computer. The world is a place full of dangers and risks and the Internet is not far behind. It’s like in Crystal Jungle, only instead of people carrying guns around, we’ll find hunched over users willing to collect information from your computer, networks, and troll you in any possible way.

Remember: “The night is dark and harbors errors”. And horrors too.

The Internet also hosts them, so to protect our beloved computer, we must make use of a “Web Firewall”. What is this “Web Firewall”?

A “Web Firewall” is a system that is intended to protect our private network and block unauthorized access or attacks from other networks. In turn, it allows incoming and outgoing traffic between computers on the same network. That is, it is like the door of your house, or, worth the analogy, a half-open blind that only lets in a specific amount of breeze according to your personal comfort.

But not only that, it can be our beloved ally, protector of what we love the most, since through configurations you may limit, encrypt or decrypt this traffic. Here’s another lucid analogy: Maybe, in your day to day, you have to go to a clandestine meeting whose members no one should know. It is similar with your computer, you may encrypt your traffic so that you cannot access the most relevant data.

The web firewall, capable of such feats, can be implemented in hardware or software. If it’s well configured, it will be an advantage when it comes to protecting your networks, so it’s vitally important to understand how it works and how you may get the most out of it.

How does a web firewall work?

murocortafuegos

Outline of a firewall on a computer network

It is usually located at the junction point between two networks. Each network or computer can have its own firewall. This can limit the consequences of an attack, as you can prevent damage from spreading from one network to another. The sooner the spread of evil is tackled, the better.

The essential thing that you must know for the operation of the web firewall is that the totality of information and traffic that goes through our router and that is transmitted between networks is analyzed by it. If the traffic complies with the rules you have configured for it, it can enter or leave your network. If the traffic does not meet those certain rules, then it will be blocked from reaching its destination.

There are several methods by which you may filter the traffic of the firewall, for example, configuring it as you please. Remember that a good firewall configuration is paramount. If the lock on your front door was badly designed and anyone could open it, bad people could get in and steal, this is the same thing.

Let’s take a look at some of the filtering methods we’ve been provided by our dear friend, the Web Firewall.

Traffic filtering methods

  • Firewall policies: They allow you to block certain types of network traffic.
  • Anti-spam firewall: It protects against spam, phishing, etc.
  • Antivirus firewall: It protects the internal network against attacks that come from the Internet or wan.
  • Content filtering: It allows you to block some types of web content.
  • WAP Managed Service: It allows you to control wap devices.
  • DPI services: It allows you to control specific applications.

There are a few types of firewalls to highlight, these can be software or hardware, and, if we investigate a little more, we will find others that are somewhat more defined.

Types of web firewall

  • Gateway application level: It applies security mechanisms for specific applications.
  • Gateway level circuit: It applies security mechanisms when a tcp or udp connection is established.
  • Packet filtering: At network level as an IP packet filter.
  • Personal: It is installed as software on your computer.

Using a firewall has lots of advantages. We already discussed some, with lots of examples and tremendous analogies, even so, we are going to list the most obvious ones:

Advantages of using a firewall

  • It blocks access to computers and/or applications to our networks.
  • It allows you to control and restrict communications between the parties under your settings.
  • It optimizes communication between internal network elements, helping to reconfigure security settings.
  • It establishes reliable perimeters.
  • Protection of intrusions and private information.

Nothing is perfect, and web firewalls, despite their fiery name, well, they aren’t either. These also have some notable limitations:

Limitations of a web firewall

  • It cannot protect itself from attacks whose traffic does not go through it.
  • It cannot protect threats made by insider attacks or negligent users.
  • It does not protect against service security flaws and protocols whose traffic is allowed.
  • It cannot protect against attacks on the internal network through files or software.

There are many firewall systems, if we use Linux, the one commonly used is Iptables. Yes, it sounds weird, we don’t like weird sounding things and since we don’t like weird things we use the firewall… Hmm… before entering a self-destructive paradox, we will try to understand what this“Iptables” is through a simple explanation.

What is Iptables?

Linux has a firewall system included in its kernel called Iptables, although its configuration can be a bit complex. Its default configuration is to allow everything to enter and exit.

With a suitable Iptables configuration you will be able to filter which packages, data or information you want to enter and which ones you do not. Just like the previous example about the inputs.

To work with Iptables you need administrative permissions so you will have to use sudo. You will have to choose wisely what you let in and what not, and, for this, an adequate knowledge of the commands that you can use in this system is necessary. The following examples are only intended to teach a basic configuration to understand the logic of the web firewall, but for a more correct and complex configuration, I recommend adding information by searching the Internet, specialized books or colleagues in the world.

Some commands to understand Iptables

sudo iptables -P INPUT DROP

-P = Anyone who wants to access the computer
INPUT = We ignore it
DROP = We ignore it

With this command nobody will be able to enter your computer, in fact you neither… so it is not the most appropriate one.

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

The first line tells us that our own computer (lo = localhost) can do whatever it wants.

Before, we said that this was like a house, if we have siblings, parents or children and they leave, we want them to be able to get in again, right? Well that’s what we do with the second line, all the connections that come out of our computer will be allowed by Iptables.

sudo iptables -A INPUT -p tcp –dport 80 -j ACCEPT

With this command, anyone can see the websites that our computer has.

-j ACCEPT = Accept or allow
-dport 80 = Traffic to port 80
-p tcp = make it tcp
-A INPUT = that is incoming

These would be some basic examples of how Iptables works. That is, just to understand the basics of its operation. Like I said, I recommend digging deeper and diving into more information to make an acceptable setup.

And just like Game of Thrones ended, this article also does it, although much better (what a crappy last season), so I only have to say goodbye and wish you to have a good day. AH! And to recommend you to use Pandora FMS, which despite not being a web firewall, is a tool that will also help you protect yourself by collecting information.

Would you like to find out more about what Pandora FMS can offer you? Find out clicking here . If you have to monitor more than 100 devices, you can also enjoy a FREE 30-day Pandora FMS Enterprise TRIAL. Installation in Cloud or On-Premise, you choose !! Get it here .

Last but not least, remember that if you have a reduced number of devices to monitor, you can use the Pandora FMS OpenSource version. Find more information here .

Do not hesitate to send your inquiries. The great team behind Pandora FMS will be happy to assist you! And if you want to keep up with all our news and you like IT, release and, of course, monitoring, we are waiting for you in this our blog and in our different social networks, from Linkedin to Twitter through the unforgettable Facebook . We even have a YouTube channel , and with the best storytellers. Ah well, we also have a new Instagram channel ! Follow our account, we still have a long way to go to match that of Billie Eilish.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Our plan for world domination: take down the internet

How to destroy the world. Is it possible to take down the internet?

We have been warning for a long time: Pandora FMS will control the world. We have given time to world governments to prepare, to North American villagers to prepare their bunker, for sects to draw their banners with “THE END IS NEAR”. And it is, it is indeed. Today, in our blog we reveal the secret plans of this company to overthrow the institutions and rule the world, then you will say that we did not warn you. Get ready, run to hide, children and gentle pets first, because the time has come: Is it possible to take down the internet?

That is the key to everything: Is it possible to take down the internet? For years, in the underground facilities of our offices, scattered across all continents, Pandora FMS has secretly worked to create an evil robot with an evil appearance that will execute even more evil plans. Its super intelligence, unattainable for any other desktop on the market, will help us take what belongs to us from this wasteland called earth and make it ours.

That is why today, on our blog (soon the only existing one) we have the exquisite pleasure to introduce you to Pandorinator RDM (Radical Destructive Mindset), the superior and ominous AI created by our company to help us in the work of crowning ourselves as the sovereigns of the world.

“Damn! Is it possible to take down the Internet, Pandorinator?! “

Pandora FMS: Good afternoon and welcome, Pandorinator.
Pandorinator RDM: Good afternoon everyone! Thank you for inviting me to this talk/colloquium at the end of the world.

Was it hard to get here with that alloy of platinum and gold that you have as armor?

Not at all. I have to get used to moving in it, otherwise one becomes paralyzed and does not come out of its hidden lair. In addition, it is a pleasure to wear it. Touch it, touch it! Don’t be shy! and watch it shine! Nor the roar of a thousand yellow suns at 12 noon radiating with their flames in summer equals it.

Let’s get to the point, Pandora FMS has always wanted to take control of the world, in fact that is why we created you, to advise us. With that said, Pandorinator, what do you recommend?

Well, a global pandemic, which is pretty trendy right now, confronting two great powers such as China and the USA, or, look, even easier, to take down the Internet.

Damn it! Is it possible to take down the Internet, Pandorinator?!

Of course it is, and I say that as an Artificial Intelligence expert on the subject of generating chaos. You only need to know inside out the critical infrastructure elements that make the Internet work.

What are these possible attack vectors?

Look, do you have a notebook there or something? Take note:

  • Specific services (web, mail, etc)

Through distributed service denial attacks, it is possible to “take down” services such as websites, applications and others. There are mechanisms to protect against these attacks (such as CDN) and today there are dozens of attacks of this kind daily, massive, but they are quickly mitigated and usually affect specific services (a company’s website) or the Internet as a whole. They often work like an extortion attack (either you pay or we take down your app). Thug life.

  • CDN

Basically they are large cache systems for publishing content, which allow Internet traffic to go smoothly. Without them, it would be much more expensive and slow to access all kinds of content, from images to text. All major media use CDNs.

The failure of a CDN can cause partial Internet blindness, cutting off access to large media simultaneously as it happened with the failure of Fastly in June 2021. There are many other CDNs and if they failed, that would mean the blackout of hundreds of thousands of websites of all kinds. The failure of a CDN only causes temporary problems (minutes/hours) in any case.

  • Domain Name System (DNS)

DNS is one of the most critical parts of the global Internet infrastructure. The downfall of all the world’s root DNS, as we know it, would truly spell chaos. There are 13 root (main) DNS servers spread across the world. They are hosted by organizations such as NASA, Verisign, the University of Maryland, or the US Army Research Laboratory. To sum it up… tough guys.

If the 13 nodes fail, although there are hundreds of thousands of secondary replicas around the world, it would be necessary to coordinate the recovery, which would lead to partial chaos all over the network. This has never happened precisely because of the security measures and the original design. But that’s what Pandora FMS and I are here for, right?

  • Cloud (Amazon, Azure)

Due to the intense concentration of many online services in public clouds such as Amazon or Azure, if one of them fails, that would mean all types of services not working anymore immediately. BOOM! Both AWS and Azure have different geographies to distribute the impact, but in the event of a physical destruction of one of their large data centers, the impact would be significant. Some premium services include automatic geographic high availability, but not all services can afford it. If the AWS data center in Ireland were destroyed by fire, tens of thousands of services would be affected for a long time.

Something similar, but on a smaller scale, happened when part of the data center of OVH, one of the largest European MSPs, got burned. Thousands of customers could not continue operating and lost data, since the backup in a different physical location was an optional service.

  • Connectivity

I know what you have in mind. A simple mind like yours might think that the simple cut of a submarine cable could blind an entire country, but the truth is that the Internet was originally designed to avoid such situations. The Internet has millions of interconnections that can be reordered automatically in case of failure of one of them to redirect traffic through the connections that are still operational.

  • Worms and Malware

A worm is a malware that is exponentially infected through the network and that can cause a collapse due to its massive use to try to replicate itself. In 1988, still at the dawn of the Internet, when technology and security were not yet very advanced, the Morris worm almost completely collapsed the Internet. Today a worm could collapse geographic sections of the Internet (such as a region) for a short time, but coordinating a massive attack is really complex to carry out without a large organization. Although, well, we could try…

It’s incredible everything you have in that quantum stubborn head we made for you, but I’m running out of pages to take note, Pandorinator RDM, could you give us any conclusions on how it is possible to bring down the Internet?

My, my, thanks for the compliment, Creator. I’ll give you your succinct conclusion: The Internet is designed for failure, so that we can lose services, but never leave the network inoperative at all. It is designed to be resilient and survive nuclear catastrophes that physically volatilize part of its infrastructure. The Internet is capable of regenerating its basic infrastructure (the routes that interconnect the nodes that make up the network) and the services that operate on them have their own ways of protecting and rebuilding themselves.

The only way we have to “turn off” the Internet is through a massive electromagnetic pulse that affects the entire planet or a massive Solar Storm. In both cases, the Internet crash would be the least of our problems.

And, listen, do you have a way to generate one of those massive electromagnetic pulses?

Me? Pay more attention! Who do you think you’re talking to? OF COURSE I HAVE! Right under this compartment, see? Even in the form of a red button.

Let’s see, let’s see…

How long will the planet as we know it last? Will Pandora FMS and Pandorinator RDM finally carry out their plans for world domination? You just have to stay tuned with our blog, our social media, and if Wi-Fi reaches you, because as the most cautious sect smokers announce: “THE END IS NEAR”.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Meet the new guy on the block: BASHware and its use in the WSL

Meet the new guy: BASHware and its use in the WSL

Antecedents

In this blog we published last year, an interesting insight of the penguin’s OS in the field of proprietary software, specifically in Microsoft® Windows®. Redmond’s company had just finished its beta phase of “Windows Subsystem for Linux”® (WSL), and we asked ourselves: “Is there security in that environment? ”.
Our rhetorical question was answered at the Rootedcon 2018 Computer Security Congress, held in the city of Madrid in March where the Checkpoint team made a presentation on the subject.

Approach of the theoretical framework

Every time a work tool is added to any software, there will always be incidences -or “bugs“- that can even be analyzed to see if they can have sneaky intentions. Originally, Microsoft® clearly explained the limitations of the WSL: it was not for production (databases, web servers) nor did it support graphic programs. In short, it was just, as we say, an “amusement park” for programmers (both hackers and crackers). In the case of us hackers, this feature saves us a lot of time, since the scripts that we have written for GNU/Linux can be executed in that private environment, but always modifying the environment variables (in any case the work of adaptation is minimal, the unit “C:\” is mounted as “/mnt/C/user”.

In order to enable the “Windows Subsystem for Linux” – which, has nothing to do with the Linux kernel, since GNU utilities really run on the Windows® kernel – you need administrator rights and you need to restart the computer. Although this fact is comforting we must take into account the following: every day Windows 10® occupies every new computer, because it comes with that operating system preinstalled. Who guarantees us that it is disabled, by default? The latter approach is derived from point 15 of the GNU General Public License: “The entire risk of both the quality and performance of the program is at your own expense,” i.e. the final responsibility for our systems always rests on our shoulders.

We must clarify that The people from Microsoft have pronounced on the matter and have refuted that this is a vulnerability of Windows® and that they will not dedicate more time to the matter (nowadays, there are no news about it), but here at Pandora FMS it is our duty to analyze as many scenarios as possible and to provide the tools; Monitoring also includes future events. We’ll write from the point of view of how it might affect our systems.

Monitoring with Pandora FMS

Another very remote possibility, more direct because it is aimed at specific local or virtual networks, is that an actor who has control over some “Active Directory” orders the WSL enablement in hundreds or perhaps thousands of machines that connect to that domain (companies and complete branches). All antivirus programs and substitutes will not detect such changes because they are simply Microsoft® applications, legitimate and digitally signed, hence our responsibility to have knowledge of such an event.

This is when Pandora FMS and its flexibility can help us in our work: we publish an introduction to log monitoring (includes link to check the approach under Pandora FMS), as well as an article in which we explain the difference between filtering and selecting “syslogs” (that are generated even when we activate some Windows® feature), which are part of the common monitoring metrics in modern operating systems. That’s why the flexibility, we insist, is patent: we can configure Pandora FMS so that it informs if some characteristic is incorporated to some computer monitored by us.

This is used to suggest that antivirus applications start taking an “inventory” when they are installed and show a warning -or block it – of possible weaknesses. We also distinguish between what is already installed and the changes made: the first is the task of the antivirus, the second are events that can -and should- detect the monitoring tools.

Terminology: BASHware

“Malware” comes from the contraction of “malicious software” and as the first word comes from Latin malitiosus. But here’s our point: massifying the term “BASHware” with malignant denotation is incorrect, “malware” exists applied in different ways because the tools that we, the network administrators, migrate are entirely innocent. Now, if a person with malicious intentions develops scripts in BASH then we are talking about “badBASHware”.

Steps to use BASHware

Windows® has always integrated its own command line, but from Windows Vista® onwards it has a more powerful tool created to match the BASH/GNU features: Powershell®.

With this tool (Powershell®) we explain the next steps:

Enabling WSL in Windows 10®

Yes, WSL is only for Windows 10®, although in the last one we enabled the remote tools for a virtual machine with Windows 7®. Powershell is active by default, we run it with administrator rights and enter the following command (we must then restart the computer or simply wait for some other frequent Windows Update® task to do it):

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux

It is also possible to enable it through a Windows terminal window:

dism /Online /Enable-Feature /All /FeatureName:Microsoft-Windows-Subsystem-Linux /NoRestart

WSL: enabling developer mode

The second thing we have to enable – and that makes the process we are proposing even more difficult – is the developer mode and making it permanent. This is accomplished by modifying (or adding) a key in the Windows® registry.

Warning: mishandling the Windows registry can lead to system corruption and even prevent system startup and even recovery. Please always test on disposable virtual machines.

In order to do this we use the command “New-Item“, to add the following key:

New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -ItemType Directory -Force

and define its property with this one, a little longer:

New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -Name 
AllowDevelopmentWithoutDevLicense -PropertyType DWORD -Value 1

Since we must check if such a key exists before setting the property to a value other than zero, system administrators like to develop scripts to save us from repeating the task again and automating everything. In this link you will be able to read a complete script ahead of its time -year 2016- and the only objection it is that it doesn’t capture the response of the New-Item command and then register in the syslog the work done with its own function intended for that purpose, called Write-CMLogEntry. A hacker cares to record for the audit logs we mentioned in section 2.1, a cracker” is not aware of this as it boasts about not leaving a trace!

Choosing Favorite BASH

Not many to choose from, but Microsoft has behaved democratically by adding more GNU distributions in addition to Ubuntu, which is the default. To date there is support for:

  • openSUSE Leap
  • SUSE Linux Enterprise Server
  • Debian GNU/Linux
  • Kali Linux
  • Short-term: Fedora
  • And many more are on the way

The most logical thing is to write for Debian and its son, Ubuntu. In any case, if we want to know which we have available we introduce:

wslconfig /l

If Ubuntu is listed, without further delay:

wslconfig /setdefault Ubuntu

Or the one you need or want, changing the last word for one of the ones that appears in the list. We are already halfway towards achieving our BASHware test!

Configuring the default user

The goal here will be to guarantee the necessary privilege, another setback for the reason of the statements of the personnel of the software of the popular window; we execute it in a sale of Windows 10® commands:

  • Ubuntu: «ubuntu config –default-user root»
  • openSUSE Leap 42: «opensuse-42 –default-user root»
  • SUSE Linux Enterprise Server 12: «sles-12 –default-user root»

Needless to say that since we are here we will be able to create our users for different tasks, that is, each user will leave different registers according to the BASHware assigned to execute. With the famous command to add users:

sudo adduser new_user_name

The icing on the cake: syslog, the event logger, although preinstalled, is not enabled by default in WSL. That problem is still open on the Github page at the time of writing and that is out of our reach and it’s a good thing we always keep it in mind.

Installing Wine

We quickly explained that Wine is software that, installed on GNU/Linux, allows certain Windows® applications to run. This is where the very remote possibility presents itself: to be able to run programs beyond the reach of antivirus programs or Windows® itself. Precisely, monitoring takes care of keeping track of these situations, although the line separating the tasks of security and monitoring is extremely thin. To illustrate this point we will say that, by way of example, data is one thing and information is another: the latter is obtained from the former by means of a process or algorithm (monitoring); this information is converted back into data when requested by the personnel in charge of security.

To install Wine, if we choose Debian or Ubuntu:

apt-get install wine

We may well install a graphical system for WSL and run Wine but we don’t want to go that far; in Wikipedia there are instructions on how to do it.

Final recommendations

While this article is written from the point of view of a possible vulnerability, we have also focused on the antivirus defenses and the control mechanisms of the OS itself against possible malBASHware. Also remember at all times that Pandora FMS is always and will be a useful tool due to its flexibility, which we can adapt to our work and the personalized alarms we have created. We can add your possible results to the Integria IMS incident management software, since it has the ability to take hardware inventory, as well as to record and categorize the requests of your users in your technical support center. Ten, a hundred or even thousands of computers: both programs are capable of satisfying the demands of your work!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×