SBS Premium + ISA = You have received an e-card?!?

On the F-Secure Weblog, we have the following article: From SMTP to HTTP to FTP where Mikko talks about the e-card spam evolution.

What Mikko is indicating to us, is that the spammers now send us to a page that will have a link to the virus file via FTP. Note the file link revealing that it is an executable file on an ftp://... at the bottom left of the Hallmark card:

We all love those Greeting Cards! ;)

So, our Favourite User clicks on the link and voila ... they get?

Well, on a vanilla, out of the box SBS 2003 Premium install with ISA 2000/4 installed and configured via the Configure Email and Internet Connection Wizard (CEICW), the user gets absolutely nothing ... zippo ... nada ... and we get a support call from Favourite User wondering why they cannot get their greeting card. ;)

The FTP protocol through the ISA server is disabled by default. We do not enable FTP unless the client specifically needs it for Web site development access to their site root. In some cases, we have a scheduled time to turn FTP access on for our client's site coders when they will be working directly on their sites. We then disable the Rule when they are done.

It has been a long time since we have had a client request FTP access for something other than Web site coding. So many software sites use HTTP for data transfers now that FTP has become something of a special need in our experience.

This situation is a good example of why we have a 95% install base of SBS 2K3 Premium at our client sites.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS, ISA & Senstive Data Transmission Security?

Obviously we never made it to the TechNet event! :D

This morning, we fielded a call from one of our clients indicating that their payroll service software was unable to transmit a Record of Employment to the payroll service server.

It was a priority situation, as the ROE needed to be transmitted by today.

It took a few steps to clarify just where the transmission was breaking down.

The ISA client was installed and connected properly, so no issue there.

The IE settings were correct, and IE was browsing the Web fine via the SBS ISA proxy settings.

With the client computer connected via one RWW Remote Assistance session, and the SBS server via another RWW TS session (two monitors), I was able to watch the ISA activity log in real-time.

What I saw astounded me!

This particular payroll application was trying to FTP the information out to their own servers! Perhaps I am wrong here, but FTP? We are talking about transmitting usernames, passwords, and highly sensitive data via an open to the public protocol.

There is a reason why the outgoing FTP protocol is disabled on the default SBS install of ISA 2004!

Call me paranoid, but in this day and age of the need for transmission security, the least the payroll application creators could do is build on SFTP, or HTTPS/POST authenticated via their software for security purposes!

They could also build a VPN structure into their software as well. The options are there for them, they just need to apply them.

We will mention to our client our concerns regarding the security setup for the payroll service software, and then I am sure they will mention it to the payroll service provider.

We have worked with a number of other payroll services companies and their proprietary software. And, in our experience, there are those out there that have adopted SSL, SFTP, and/or other secure methods of moving data between their client and their own servers. Just not this particular one.

Something to keep in mind if there is a need to outsource payroll IMNSHO.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists