Cupfighter.net

A few days ago I had a meeting with some fellow security officers and an interesting topic came up: “What is the value of putting up disclaimers when logging into systems”

I think we have all seen them, the annoying pop-up messages or scrolling text before you log onto a system telling you that it is an offence to log on unless you are authorized, etc, etc. If you do not know what I am talking about, here is the MS knowledge base article on how to set it up on a windows box.

The debate was around the question if such disclaimers actually add any security to the system. In order to answer that question we need to understand the origin of the disclaimer a little better. Apparently there has been a a court case in which an hacker who was changed with breaking into a computer system by guessing the administrator password successfully defend himself by stating that when he first opened the system he was asked to “Please enter your username and password”. When he entered his username and password he got a message stating “invalid username or password, please try again”. So he was not trying to break into the system, but just doing what he was requested.

This little story makes me wonder, would this excuse for hacking still fly today. As I am not a lawyer (or have any intentions of becoming one) I am in not a position to give an authoritive answer, but I am going to make a guess based on what I do know about Dutch law. In order for someone to be found guilty of trespassing (either IRL or on a computer) you must prove that the person entered an “area” that he was not allowed to enter and that he knew was restricted. In other words if you just happen to wonder into an restricted area, but you were unable to know that you should not go there it is not trespassing. However if you did jump a fence in the progress, you would be hard put to state that you were not aware. In the case of a computer it would be my opinion that having to enter a username and password should be sufficient reason for you to know that the system is restricted.

In my opinion this measure is one of those measures that we take out of sheer inertia, or to keep up with the Joneses, just like changing your password every month or putting a disclaimer on the bottom of an email.

Like the disclaimer, the monthly password change has a historical origin. Rumor has it that the “industry standard” monthly password change is derived from a calculation of how long it would take to perform brute force password attack on an old mainframe. Based on the outcome of this calculation (two months) changing  your password every month very effectively reduces the risk of your password being cracked. However, the basic assumptions on which this habit is based have changed dramatically. For example due to Moore’s law and Rainbow tables.

Does sticking to these out-dated practices hurt? On the one hand these measures are cheap to implement. It only takes some changes to the registry, group policy or a text file. On the other hand they can be counterproductive. The disclaimer can cause annoyance when you have to click it away multiple times a day and will certainly not be read every time it is displayed.

The once a month password change is worse, because it encourages bad password practices like writing passwords down or using numbered increments. (Password03, Password04, etc)

Better alternatives like awareness trainings and dual factor authentication are available.

I would like to hear your thoughts on the matter fbreedijk (at) schubergphilis (dot) com

From: http://bink.nu/news/windows-7-windows-server-2008-rtm-set-for-july-13th.aspx

4 days earlier then I had in my previous schedule, Microsoft has now set July 13th for RTM “sign-off”

Sign off is the process where all divisions sign that they agree on the final code, which means the actual RTM build will be created a few days earlier, which is targeted on July 10th.

The general availability (GA) is set to October 22nd, this is when you can buy it in stores in a box or on new PC’s (OEM).

We can expect the RTM much earlier on MSDN, Technet and Volume Licensing download sites, probably a few days after July 13th.

This is not so new news, but still want to drop some frustrations here…
While trying to record audio from my system for a screencast I discovered that I was unable to select sound from my speakers (waveout mix, stereo mix or sometimes called “What you hear”). At first I thought this was a Windows 7 issue with my drivers. But upgrading my drivers from the ones supplied by Microsoft to the ones supplied by Lenovo for my T500 did not help either.  So I contacted my buddy Google.

Soon I found some discussion on this topic on several forums including the Lenovo support forums.

Lenovo has an official kb article on this:
http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-70822&selectarea=SUPPORT&tempselected=5

The solution according to Lenovo:

Symptoms #1 and #2 were caused by a design change agreement between Microsoft and the audio chip hardware supplier. The new change drops the support of mixed-stereo function and direct playback of microphone. The change in design calls to have these function implemented in application level in future. The goal of this design change is to begin standardizing the audio industry. The design change affected all PC vendors worldwide. In the future, Microsoft and audio vendors expect individual applications developers pick up these functions.

The industry has been trying to protect digital rights for ages without much luck so far. And consumers are fighting this with all sorts of workarounds.
So I started looking for workarounds on this one…  since I am not trying to workaround DRM, but just want to create a webcast using sound from my PC. (In this case a demo of the Flash HDX Experience Tech preview of Citrix).

Some Workarounds I found but did not work for my T500 with Windows 7:

• Change driver inf file from crippled drivers
• Stick a cable between headphones out and mic… does not sound like a very good idea…mic-input is mono and will give you terrible sound.. and maybe even blowing up your soundcard (mic’s are passive devices)
• Buy an external Audio card, USB or PCMCIA… but we did not buy quite expensive notebooks to buy extra soundcards…
• Use Virtual Audio Cable

I tried the last without luck either because. The installation went OK but after the installation I got this pop-up:

Mmm, wonder if this kind of driver ever gets digitally signed. This also counts for Vista X64 versions.

Apparently other major vendors, like Dell and Packard Bell introduced the same issues. Dell however fixed it with an driver updated, since they only crippled the driver. But with Lenovo however it seems to be hard coded in the chip (In my case a Conexant High Definition SmartAudio 221).

Rumors go that this was done under the pressure of the RIAA (Record Industry Association of America).

For now I can only record my microphone sound… yeah! I wonder where this goes in the future… and if you have a solution to workaround this issue… please drop a comment, thanks.

The only workaround I found to record “what you hear” is to use Total Recorder Pro, which installs a signed kernel driver to record all sounds. I installed a trial which seems to really work on Windows 7, but I haven’t figured out on how to use this kernel driver to record Audio in other applications. Or use the Physical Cable solution…

More info here:
Lenovo Support forum thread
Ripten on Dell Stereomix issue

Comparing version numbers can be tricky from time to time, before you know it you end up in auto-casting issues comparing strings to integers etc. The most common format of a version number in Windows is “Major. Minor. Build. Revision” where each individual item is a figure, but because of the separating dots PowerShell will treat each item as a string.

The .Net System.Version assembly offers a CompareTo method which can do the trick, as shown in the figure below.

The CompareTo method will return 1, 0 or -1  depending whether the compare to version  is higher, equal or lower.

Thanks to Shay Levi (see the comment) I now know a better/faster method for comparing version numbers (thaks Shay). PowerShell has its own [vesion] type. This removes the need of loading the assembly and using New-Object. It still allows for using the CompareTo method and direct compare via -ge, -gt, etc.

The CompareTo method will distinguish between the 3 possibilities (>, < or =), but direct comparison might be sufficient in a script.

Today I spent most of my time analyzing the Slowloris and Nkiller2 denial of service (DoS) tools together with my colleague Gert Kremer.

Slowloris (name after the slow moving primates is a httpd DoS tool written by RSnake of ha.ckers. It works by tying up the httpd worker processes by slowly sending more and more headers of an httpd request.

Nkiller2 is a TCP/IP DoS attack tool which was published in issue 66 of Phrack magazine. It works by tying up httpd worker processes by requesting a file then stalling, mimicking the behavior of a client with full TCP/IP receive buffers.

Cisco CSS is a load balancer produced by Cisco.

In nearly all of the infrastructures built by my employer Schuberg Philis, the web servers are located behind a load balancer. In most cases a Cisco CSS. Because some of our customers were worried, I set out together with my colleague Gert Kremer to see if having a CSS load balancer in front of the web server provides any protection.

Slowloris

First we just had to try and find out what Slowloris did with an unprotected Apache server. The first video shows what happens when you run slowloris against a webserver. The window on the top left shows the number of apache processes, the top right window shows the scoreboard. This shows what the http processes are actually doing. The bottom window shows the slowloris output.

Slowloris vs Apache (No load balancer)

When slowloris is using 100 sockets, you can see 100 httpd workers in state “R”, meaning it is reading requests. The same is the case when running with 200 and 250 sockets. When running with 300 sockets the apache worker processes pool is exhausted and the web server can no longer service requests.

Slowloris vs Apache behind a Cisco CSS load balancer

Slowloris is running against the webserver with 3000 sockets (should be more then enough). As you can see on the top two windows the load balancer does not forward any of the incomplete requests to the webserver. We have stress tested the loadbancer up to 10,000 sockets and it had no effect on the loadbancer.

NKiller

Nkiller vs Apache (No load balancer)

In the video we see for windows. Top left and right show the number of apache processes and the apache dashboard. The middle window displays the NKiller output and the bottom window TCPdump.

When NKiller starts we see the it exhausts the httpd workers processes by putting them in a state where they are hanging while writing their reply back to the client.
Nkiller vs Apache behind a CSS load balancer

When NKiller was used against a server protected by a Cisco CSS load balancer the packets received from the load balancer do not match the expections of the Nkiller tool and the tool crashed producing a segmentation fault.

PowerShell allows for inline parameter control for some of its cmdlet parameters. Based upon commandline and/or inputfile content you might want to turm some of the cmdlet parameters on or off.

For example: scripts manipulating files will often use the Get-ChildItem cmdlet in combination with the -recurse parameter, but not allways the subfolder files are required. Instead off having multiple Get-ChildItem commandlines (each with their own set of parameters) a single line might be possible.

The following examples use the Get-ChildItem cmdlet to show what I mean.

The command in figure below will display all *.tmp files in the current folder and its subfolders.

By extending -recurse with :$false recursive lookup will be turned off.

On the otherhand, replacing $false with $true will turn recursive lookup on again.

So using a boolean variable we can turn recursive lookup on or off from within the script (-recurse:$RecurseOnOff). And of course this method also works for other parameters.

And it does get stranger….. in some occasions you can also reverse the default action of a parameter. Hence the following figure.

The 1st command will show all files with exception of the *.tmp files. By appending :$false to -exclude, we turn -exclude into -include as demonstrated by the 2nd command.

This form of parameter manipulation offers a scala of possibilities. Using script parameters to control cmdlet behaviour can both decrease script size and complexity.

Have fun experimenting with this little trick

“Just becuase I can…” is often the only justification you need to do something cool.

It is most probably the reason that Johan van den Brande decided to write a Twitter application for his Commodore 64.

http://www.vandenbrande.com/wp/2009/06/breadbox64-a-twitter-client-for-the-c64/

P.S. Michael, thanks for the tip.

http://www.globalfoundationservices.com/security/documents/SecuringtheMSCloudMay09.pdf

While troubleshooting some DFSR today, I came across this very nice and detailed post from the Directory Services Team.

From: http://blogs.technet.com/askds/archive/2009/03/23/understanding-dfsr-debug-logging-part-1-logging-levels-log-format-guid-s.aspx

Ned here again. Today begins a 21-part series on using the DFSR debug logs to further your understanding of Distributed File System Replication. While there are specific troubleshooting scenarios that will be covered, the most important part of understanding any products logging is making sure you are comfortable with it before you have errors. That way you have some point of reference if things go wrong.

As you can probably guess, these posts were a long time in development. They are based on an internal DFSR whitepaper I have worked on for six months, and which went through review by a number of excellent folks here in Support, Field Engineering, and the Product Group itself. Except for the removal of all private source code references, this series is otherwise unchanged.

I’ll start with a couple posts on the logs themselves, how they are formatted, how they can be controlled, etc. Then I’ll dig into scenarios in detail, for both Windows Server 2003 R2 and Windows Server 2008. Don’t feel like you have to read and memorize everything – this series is a reference guide as well.

Understanding DFSR debug logging (Part 1: Logging Levels, Log Format, GUID’s)
Understanding DFSR debug logging (Part 2: Nested Fields, Module ID’s)
Understanding DFSR debug logging (Part 3: The Log Scenario Format, File Added to Replicated Folder on Windows Server 2008)
Understanding DFSR debug logging (Part 4: A Very Small File Added to Replicated Folder on Windows Server 2008)
Understanding DFSR debug logging (Part 5: File Modified on Windows Server 2003 R2)
Understanding DFSR debug logging (Part 6: Microsoft Office Word 97-2003 File Modified on Windows Server 2008)
Understanding DFSR debug logging (Part 7: Microsoft Office Word 2007 File Modified on Windows Server 2008)
Understanding DFSR debug logging (Part 8: File Deleted from Windows Server 2003 R2)
Understanding DFSR debug logging (Part 9: File is Renamed on Windows Server 2003 R2)
Understanding DFSR debug logging (Part 10: File Conflicted between two Windows Server 2008)
Understanding DFSR debug logging (Part 11: Directory created on Windows Server 2003 R2)
Understanding DFSR debug logging (Part 12: Domain Controller Bind and Config Polling on Windows Server 2008)
Understanding DFSR debug logging (part 13: A New Replication Group and Replicated Folder between two Windows Server 2008 members)
Understanding DFSR debug logging (Part 14: A sharing violation due to a file locked upstream between two Windows Server 2008)
Understanding DFSR debug logging (Part 15: Pre-Seeded Data Usage during Initial Sync)
Understanding DFSR debug logging (Part 16: File modification with RDC in very granular detail (uses debug severity 5))
Understanding DFSR debug logging (Part 17: Replication failing because of blocked RPC ports (uses debug severity 5))
Understanding DFSR debug logging (Part 18: LDAP queries failing due to network (uses debug severity 5))
Understanding DFSR debug logging (Part 19: File Blocked Inbound by a File Screen Filter Driver (uses debug severity 5))
Understanding DFSR debug logging (Part 20: Skipped temporary and filtered files (uses debug severity 5))
Understanding DFSR debug logging (Part 21: File replication performance from throttling (uses debug severity 5))