 |
 |
|
October 28, 2008HOWTO Video: Account auditing for group membership changesOn one of the mailing lists I monitor I noticed many of the SMB admins do not know how to do account auditing. This is quite surprising to me, as I thought it was a given. The video will show you how to quickly configure account auditing using the domain security policy and then use free Microsoft tools like EventCombMT to quickly query across all your servers in your domain looking for critical events like 660 (user added to a security group) and 661 (a user removed from a security group). From there... the world is in your hands. You can easily cross query looking for specific accounts etc to accomplish EXACTLY the kind of auditing we are talking about. October 24, 2008Careful about the analysis you read about MS08-067So unless you have lived under a rock since Tuesday, you know about MS08-067. It is a out-of-band security bulletin about a vulnerability in the Server Service that will allow complete code execution from a remote attacker. It's rather nasty. And there are PoC trojans and worms already in the wild. But I don't want to talk about the vulnerability. Everybody in the world has been doing that. I want to talk about the ANALYSIS of it. First off, there is some GREAT SDL analysis from Michael Howard over on the SDL blog. (You can read it here) Michael poses the question why SDL didn't catch this, and goes into detail discussing what mitigating circumstances exist around the code analysis... and how SDL DID work here. It's a great read. What is MORE concerning to me though is some of the poor analysis. Jesper and I were looking at some decompiled code Alexander Sotirov released and it is apparent that there is some small but CRITICAL errors in his deciphering of the code. As an example, there is one block which reads:
while (*p != L'\\' || *p != L'/')
{
if (*p == L'\0')
return 0;
p++;
}
It took me a few times looking at that code to realize that it is quite possible that the loop would cause the function to bail out way before it could get to the real meat of MS08-067, because the loop always results to TRUE. After looking further at the comments in the code and completing a truth table, it was clear to Jesper and I that this code seems suspicious... to many faults and a coding style that simply isn't how Microsoft writes code. BTW, if you don't see the problem with the loop, realize that it should be an AND, not an OR. A path of '\\server' will always bail. If this simple issue was wrong in the decompile, what else could be wrong? Anyways, to confirm the code was questionable I loaded netapi32.dll into IDA Pro (god I love that tool) and broke it down to check. Sure enough... that code analysis was NOT correct. In a few places. Lesson to learn here is that on the Internet, everyone has a voice. What you choose to believe is really up to you. But don't believe all the analysis out there. It simply isn't correct. MS08-067 is bad. Patch NOW. Leave the code analysis to us. :) October 05, 2008Top 10 WOW Features on SBS 2008 which will make me switch from SBS 2003SBS 2008 is an interesting beast. For some time now I have stated that I didn't feel there was an "WOW factor" in the product; SBS 2003 is just too damn good and there was no compelling reason to switch. So last week while attending some deep dive training at Microsoft on the latest SBS 2008, I started to realize that I was wrong. There may not be a lot of SBS specific things that make a difference, but there is PLENTY of WOW in the product suite. So much so, that I am DEFINITELY upgrading. Throughout the process, I started making a list of what I thought would really impact me and my business. And I promised my Microsoft MVP peers at the training that I would share them with the world, but only if some of them did so as well. So to start the chain off, here are the "Top 10 WOW Features on SBS 2008 which will make me switch from SBS 2003", in no particular order:
Over all, these 10 features make me realize the business benefits of SBS 2008. The WOW is the fact everything works together with refreshed code (Windows Server 2008, Exchange 2007, Sharepoint 2007, SQL 2008, etc) and will make our business IT infrastructure more streamlined, cost-effective, and in line with our business processes in the office. Many small pain points will be solved, and I believe we will see real returns in how more productive we can be in the face of system rebuilds, better information storage controls and backups. So I will be upgrading to SBS 2008 when I can. Will you? If so, what's your top 10 reasons to do so? Blog it, and then leave me a comment here. |
 
My 5 Favorite Books
Writing Secure Code
Secure Programming Cookbook Security Engineering Secure Coding Principles & Practice Inside the Security Mind
My 5 Favorite Papers
Smashing the Stack
Penetration Studies Covert Channel Analysis of Trusted Systems DoD Trusted Computer System Evaluation Criteria NSA Security Recommendation Guides
Archives
March 2010
October 2009 August 2009 May 2009 April 2009 March 2009 February 2009 January 2009 December 2008 November 2008 October 2008 September 2008 August 2008 July 2008 June 2008 April 2008 January 2008 December 2007 November 2007 October 2007 September 2007 August 2007 July 2007 June 2007 May 2007 April 2007 March 2007 February 2007 January 2007 December 2006 November 2006 October 2006 September 2006 August 2006 July 2006 June 2006 May 2006 April 2006 March 2006 February 2006 January 2006 December 2005 November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004 May 2004 April 2004 March 2004 February 2004 January 2004 December 2003 November 2003 October 2003 September 2003 August 2003 July 2003 June 2003 May 2003 April 2003 March 2003 February 2003 January 2003 December 2002 November 2002 October 2002 September 2002 August 2002 July 2002    
|
|