 | | |
| | |
|
Spaces home  Montreal blog on Interne...ProfileFriendsBlogMore |  Tools   |
|
|
May 13 Setting privileges on a specific threadIf you've ever needed to set privileges to a specific thread Id only, and not an entire process, you may of visited quite a few MSDN web pages trying to figure out exactly how to achieve this.
Here is a function that does this, call it using a format such as:
AddThreadPriv(GetCurrentThreadId(), SE_BACKUP_NAME);
AddThreadPriv(const DWORD in_tid, const std::string& in_rstrPrivilegeName)
{ ImpersonateSelf(SECURITY_MAX_IMPERSONATION_LEVEL); HANDLE h = OpenThread( TOKEN_ALL_ACCESS, FALSE, in_tid);
HANDLE hToken = NULL;
if(h)
OpenThreadToken(h, TOKEN_ALL_ACCESS, TRUE, &hToken); if( hToken )
{ TOKEN_PRIVILEGES tpNew = { 1 }; tpNew.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; if( ::LookupPrivilegeValue( NULL, in_rstrPrivilegeName.c_str(), &tpNew.Privileges[0].Luid ) )
{ VERIFY( ::AdjustTokenPrivileges( hToken, FALSE, &tpNew, 0, NULL, NULL ) ); CLOSEHANDLE(h);
CLOSEHANDLE(hToken); return (ERROR_SUCCESS == GetLastError());
} } CLOSEHANDLE(h);
return false; } Trying to locate the proper documentation shouldn't be this difficult, certainly not for a company that size.
May 10 IPv6 is good for business, and will flush out unmaintained crapwareIpv4 will be out of addresses sooner than most people realize.
This will probably occur within 24 months, and will likely cement Vista as the desktop os replacement for Xp, since its stack has IPv6 out-of-the-box.
The good news is that this will weed out the smaller software products who do not have the man-power to upgrade their existing applications to this newer reality.
We may even see well established products lag behind because they may be dealing with too much legacy Ipv4 code.
Time will tell... May 06 What Will Microsoft Do With Credentica?
Written by Bernard Lunn / May 3, 2008
http://www.readwriteweb.com/archives/what_will_microsoft_do_with_credentica.php
May 05 The Race to ZeroThe Race to Zero contest is being held during Defcon 16 at the Riviera Hotel in Las Vegas, 8-10 August 2008. The event involves contestants being given a sample set of viruses and malcode to modify and upload through the contest portal. The portal passes the modified samples through a number of antivirus engines and determines if the sample is a known threat. The first team or individual to pass their sample past all antivirus engines undetected wins that round. Each round increases in complexity as the contest progresses.
April 21 Speed up that old systemIs your dev machine running slower due to the increased number of software pieces tacked on over the years?
Clean up your registry, remove duplicate files, and then defrag the drive for that new-car smell.
Here are three free utilities to do just that:
Eusing Free Registry Cleaner
DoubleKiller
Defraggler
April 18 I actually hit an XP Home LimitationI think this is a first for me. I do not think I've ever had to choose one flavor of an OS over an other because of a feature set.
I'm configuring some of my home LAN and set up remote desktop on the machines so I can log onto each one from my laptop.
Except for one.
You can't remote desktop to an XP Home edition.
So I installed something I haven't used in forever, vncviewer. It works OK, but IFF you lock the computer running the vnc server, you can't connect to it; something which is not a limitation using remote desktop.
April 15 Microsoft has released Microsoft Security Development Lifecycle, version 3.2Microsoft has released Microsoft Security Development Lifecycle, version 3.2
Tons of great recommendations for your development team, to better your software product, such as
Code priority definitions are provided in the following list: · Pri1 code is considered the most sensitive from a security standpoint. The following examples of Pri1 code are not necessarily a definitive list: · All Internet- or network-facing code · Code in the Trusted Computing Base (TCB) (for example, kernel or SYSTEM code) · Code running as administrator or Local System · Code running as an elevated user (including LocalService and NetworkService) · Features with a history of vulnerability, regardless of version · Any code that handles secret data, such as encryption keys and passwords · Any unverifiable managed code (any code that the standard PEVerify.exe tool reports as not verified) · All code supporting functionality exposed on the maximum attack surface · Pri2 is optionally installed code that runs with user privilege, or code that is installed by default that does not meet the Pri1 criteria. · Pri3 is rarely used code and setup code. (Setup code that handles secret data, such as encryption keys and passwords, is always considered Pri1 code.) · Any code or component that has experienced large numbers of security bugs is considered Pri1 code, even if it would otherwise be considered Pri2 or Pri3. Although the definition of large numbers is subjective, it is important to scrutinize carefully the portions of code that contain the most security bugs.
Here's a table of recommended settings compiler/linker settings for unmanaged code. Win32 Requirements: Unmanaged CodeTable G.1. Win32 Requirements: Unmanaged Code
April 09 Been a target of an attack?What do you do if you receive a phishing email?
And what will you do if you find a site which is distributing malware?
I gathered a list of emails and forms which can be used for reporting phishing sites, phishing emails, and malware sites:
Report a site that you suspect contains malicious software.
http://www.google.com/safebrowsing/report_badware/ http://www.stopbadware.org/home/new Forward phishing emails to my company: fraudsubmission@radialpoint.com To fraud watch international: scams@fraudwatchinternational.com To APWG: reportphishing@antiphishing.org If you have found a security vulnerability in any of Microsoft’s online services,
secure@microsoft.com spyware or other malware submission to
windefend@submit.microsoft.com April 08 Stroustrup Says C++ Education Needs To ImproveAlthough I rarely head over to slashdot anymore, (I prefer Digg), but once in a a while there's a great thread over there.
This thread http://developers.slashdot.org/article.pl?no_d2=1&sid=08/03/30/1155216 on C++ really shows how much developers either really love it, or hate it.
One thing is sure, C++ 'experts' are few and far between. With the upcoming TR1 adding yet more to the language, it's difficult just to keep up with everything.
I can't imagine a newbie trying to step through 8 boost pointer indirections and not getting discouraged, or trying to decipher template compiler errors.
For a TR1 overview, check out Pete Becker's book.
April 01 Et tu, Amazon?
Amazon has DRM free music. If you want to download songs, that's what you need to be using, not iTunes. But, I tried purchasing the latest Moby CD MP3's, and because I'm a Canadian customer it won't let me. This reminds me of that great pandora.com service which every coder here used, before it too shut down streaming to Canadian IPs.
March 25 OpenDNS rocks!So far this year I am using two amazing products.
Jungledisk has rendered all my USB keys useless. I have it installed on all my machines, my sample code and all my tools are saved in the amazon cloud.
I don't even use its backup ability, just the storage space. Finally no more stumbling around my DVDs looking for some old piece of code which I now need!
And OpenDNS rocks. Is it faster? Maybe. Is it safer? Maybe? is it better? Absolutely. Here's what I like most, besides the fact its free:
I no longer need to run my parental control tool client-side? Why is this good?
- Less client-side code means your Cpu is free to do other things
- Less client-side code means less risk of it crashing
Now, my parental tool is good, I was one of the guys who wrote it. I even optimized the networking code of late. But it uses an OOB network call to validate Urls! It cannot possibly go faster than a DNS based solution.
Now, instead of validating pbdkids.org (while the browser sits there and waits), by sending the Url to another server which categorizes the Url, the categorization is done at the DNS request level. Here's a snapshot of the OpenDNS web site where you can configure your networks:
March 14 Anti-Malware field keeps getting more crowdedAnother new Anti-Malware company is launched: http://blogs.zdnet.com/security/?p=366
I have installed their product on a couple of my machines, and I really like it so far. I've been a proponent of securing the HTTP pipe between clients and web sites; that can provide users MORE security than an up-to-date Av definition file...try it out, it's free http://hautesecure.com/index.aspx
They seem to use the google safe browsing API to use the google blacklists (phishing + malware), http://code.google.com/apis/safebrowsing/developers_guide.html in addition to other feeds. They send the URL to a backend (here's an actual trace for offensive-security.com):
- Http: Request, GET /v1.2/QueryUrl.aspx
- Request: Command: GET - URI: /v1.2/QueryUrl.aspx?Url=http:%2F%2Fwww.offensive-security.com%2F&HostId=6d0c1292-5589-4648-83c8-c68ed1a95adb&ClientVersion=1.2.1.1906&QueryThirdParty=1&QueryFrom=Client - Uri: Location: /v1.2/QueryUrl.aspx Url: http:%2F%2Fwww.offensive-security.com%2F HostId: 6d0c1292-5589-4648-83c8-c68ed1a95adb ClientVersion: 1.2.1.1906 QueryThirdParty: 1 QueryFrom: Client ProtocolVersion: HTTP/1.1 UserAgent: HauteSecure 1.0 Host: communitystats-cws.hautesecure.net HeaderEnd: CRLF This is similar to the solution we use in our security product, which also validates URLs against a phishing blacklist (not a malware blacklist though).
"The four founders are Iain Mulholland, a former security strategist and manager of the MSRC (Microsoft Security Response Center); Frank Swiderski, a software architect who did stints at Microsoft and @Stake; Rob Vucic, who worked at Redmond on Microsoft’s Secure Windows Initiative Internet Crime Investigations team; and Steve Anderson, who worked on the Windows Server team at Microsoft....TechCrunch reports that the company launched with $500,000 in funding"
500K$ !? That's it? Ask my friend Austin, who's recently blogged about a couple of Montreal based shops being bought by US companies, will tell you that that's peanuts!
March 11 Great vacation readingI had the pleasure of reading The Web Application hacker's Handbook on my vacation.
It's terrific, check it out on amazon: The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws
 February 25 Disk encryption may not be secure enough, new research findsYet more proof that in computer security, there is no silver bullets and no free lunches.
Read the article here. February 22 "The Incredi" attackI was probing a possible attack vector in a "security suite" type application, and found an interesting twist based on, The Incredibles of all things...
Recall the scene where Mr Incredible has trouble fighting off a robot, and ends up winning by having the robot attack itself? By using clever tricks, we can convince "security suites" to attack specific files, and remove them, simply by having the file trigger a hit (a positive virus detection).
How is this possible? Well, today's security vendors are constantly battling to achieve levels of certification by detecting as many malwares as possible, they want to add database entries!
I won't list real-world examples, but here's an example:
Just run [echo "removed for security purposes" > filetoberemoved] and presto!
Obviously here I can just remove the file my own self, but in fact I have the anti-malware level do so, which they often can do with elevated privileges! February 20 Welcome to the jungleI finally started using jungle disk, and after a little problem with it on Vista (which I managed to workaround) I really enjoy it! Not only is it dirt cheap, but you use your existing Amazon account to pay...I use picasa for pixs simply because it finds the pictures locally easily, but that seems to have an upper limit of 1 G only.. February 18 Windows Vista Media Center + Xbox 360I set up a small home network (3PCs), with Vista Media Center on a laptop.
It detects the digital camera, imports the pictures, easily and seamlessly.
Then, one day, I had the Xbox 360 console on, and it detected this (they are not connected, but only share the same router) after which the Vista Media center asked me if I wanted to add it as an Extender.
Without any other configuration, I was browsing pictures (from the laptop) on my TV using the Xbox 360!!!
The only downside to my Vista+Xbox+HD Tv setup is the fact that I have an Xbox HD-DVD...something which will apparantly be replaced with Blu-Ray eventually. Perhaps Microsoft will put out a dual-reader. |
|
|
Print
