Immutable Security Laws and Windows Sidebar Gadgets

Immutable Security Law number 1: If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore I love the Immutable Security Laws – they strike a chord deep within me, and they’re a “go to” resource every time I want to decide if I’m making a good security decision. I also like my Windows Sidebar Gadgets. Not a whole lot of them, mind you, just one or two that I’ve written myself. And I can’t say that I’ve gone very deep in developing them. So I’m deeply conflicted when I see “Microsoft … Continue reading Immutable Security Laws and Windows Sidebar Gadgets

The power of stupidity

I just spent a couple of days trying to figure out why logon-related code that worked in Windows XP failed in Windows Vista and Windows 7. hToken = NULL; if ( LogonUser( g_sUser, bIsUPN ? NULL : g_sDomain, g_sPass, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken ) ) { // Re-populate the g_sUser and g_sDomain values from the token! TOKEN_USER tUser; DWORD nLength; // Get the user / domain information from the token. if (GetTokenInformation(hToken,TokenUser,&tUser,sizeof tUser,&nLength)) { SID_NAME_USE eUse; DWORD dwUserSize = _countof(g_sUser); DWORD dwDomainSize = _countof(g_sDomain); LookupAccountSid(NULL,&tUser.User.Sid, g_sUser, &dwUserSize, g_sDomain, &dwDomainSize, &eUse); } CloseHandle(hToken); } [Note that some error handling has been removed … Continue reading The power of stupidity

Starting to build your own Credential Provider

If you’re starting to work on a Credential Provider (CredProv or CP, for short) for Windows Vista, Windows Server 2008, Windows Server 2008 R2 or Windows 7, there are a few steps I would strongly recommend you take, because it will make life easier for you. 0. Read Dan Griffin’s article in MSDN Magazine. The article, "Create Custom Login Experiences With Credential Providers For Windows Vista" by Dan Griffin in January 2007’s MSDN Magazine on Credential Providers is a truly excellent source of information, gleaned largely by the same exhaustive trial and error effort that you will be engaging in … Continue reading Starting to build your own Credential Provider

Weird virus / anti-virus behaviour

My wife and I pent a while this weekend trying to figure out how to rescue a Media Center that seemed to be going a little loopy. The Windows Media Center application itself worked fine, as did Windows Media Player, Calc, etc. Only Internet Explorer was failing. If you press Ctrl-C from most Windows dialog boxes like the one above, it will copy the text of the dialog into the clipboard. Here’s what I get if I do that (this is mostly aimed at people using search engines): [Window Title] C:\Program Files (x86)\Internet Explorer\iexplore.exe [Content] C:\Program Files (x86)\Internet Explorer\iexplore.exe The … Continue reading Weird virus / anti-virus behaviour

Comcast aims for the future

I’m visiting the in-laws in Texas this weekend, and I use the SSTP VPN in Windows Server 2008 R2 to connect home (my client is Windows 7, but it works just as well with Vista). Never had many problems with it up until this weekend. Apparently, on Friday, we had a power cut back at the house, and our network connectivity is still not happening. I’ve asked the house-sitter to restart the servers and routers where possible, but it’s still not there. So I went online to Comcast, to track down whether they were aware of any local outage. Sadly … Continue reading Comcast aims for the future

TLS Renegotiation attack – Microsoft workaround/patch

Hidden by the smoke and noise of thirteen (13! count them!) security bulletins, with updates for 26 vulnerabilities and a further 4 third-party ActiveX Killbits (software that other companies have asked Microsoft to kill because of security flaws), we find the following, a mere security advisory: Microsoft Security Advisory (977377): Vulnerability in TLS/SSL Could Allow Spoofing It’s been a long time coming, this workaround – which disables TLS / SSL renegotiation in Windows, not just IIS. Disabling renegotiation in IIS is pretty easy – you simply disable client certificates or mutual authentication on the web server. This patch gives you … Continue reading TLS Renegotiation attack – Microsoft workaround/patch

Why .NET apps keep crashing on your Tablet PC

I’ve been struggling with this issue for some time. I have a small, simple .NET application I wrote in Visual C# a few months ago – I’ve tentatively titled it “iFetch”, because it fetches radio shows from the BBC iPlayer. It really is very little more than a simple data grid view that displays the details of the shows and allows users to select them for downloading and later listening. Despite that, I’ve had some terrible trouble with it. Sometimes it’ll work perfectly, other times it’ll just suddenly crash, and apparently without warning and for different reasons – sometimes when … Continue reading Why .NET apps keep crashing on your Tablet PC

Running out of disk space? How’s your logs?

I ran out of disk space today. This is not entirely a new issue for me, because I like to listen to BBC Radio from back home, and my only way to do that is to download the shows overnight so I can listen to them the next day. [I’m not allowed that sort of bandwidth at work] I start troubleshooting this in the obvious way – where are my largest individual files, and are they useful? Windows Vista’s Search is great for this – you can ask for files over a certain number of bytes:   Whoa, over a … Continue reading Running out of disk space? How’s your logs?

Redmond Report says “Vista Kernel Flawed”

This is just some lovely reporting: Vista Kernel Ready To Pop? Vista, due largely to its lockdown of user rights, is far more secure than XP. But it’s not 100 percent safe. In fact, the kernel itself has an issue that could lead to buffer overflow attacks, or so says security company Phion. Well, that’s hardly surprising, we know how common buffer overflow attacks are, and how difficult they are to prevent. Go on… The exploit, which does require admin privileges, is pretty well-documented by Phion. And there’s no patch — just a workaround from the company. Hmm. Is Phion … Continue reading Redmond Report says “Vista Kernel Flawed”

Windows 7 officially has a name

So, what’s the scoop? It’s going to be called “Windows 7”, according to Mike Nash posting at the Windows Vista Blog. [Is it just me, or does Mike Nash look a little like the chef who got into trouble for inflating his resume in the opening credits to “Dinner: Impossible”? ] How sneaky of Microsoft, to fool us into thinking that “Windows 7” was just the code name, when in fact it was also the release name! Me, I think it’s because there was just no good way to include hints of the code-name in the final release name, like … Continue reading Windows 7 officially has a name