skip to main |
skip to sidebar
Ever want to prevent a user from attaching a USB drive? Well, you could turn off USB in the system BIOS, but that prevents attachment of all USB devices, not just drives. That could be disastrous if you don't have a PS/2 Keyboard and Mouse attached.
There's a simple registry hack that manages how Windows XP SP2 and later and Vista manage attached drives (including external hard drives as well as flash) but not prevent the use of HID devices and other non-drive devices. There's a very good write-up on the How-To Geek. The hack can be summed up in this simple line:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
"WriteProtect"=dword:00000001
For more security, you can look at physical protection. Unfortunately the USB physical standard doesn't allow any realistic way to permanently lock the drives, but you can block them. Lindy makes USB port blockers that will at least deter casual attempts to plug in USB and at least slightly slow determined users. They can be removed with a carefully bent paper clip, but once in, you can't easily remove with bare hands. Different colors use different keys to remove. Of course, you can buy them in colors other than pink...
Telnet is bad, mkay? It's insecure. I get it. Everything goes in plaintext totally in the clear. However, it's still a useful tool. Vista (including Ultimate) apparently feels that such a powerful tool should be hidden away from prying eyes and doesn't install it by default.
To install the Microsoft telnet client, do the following:
1. Go to the Control Panel
2. Open Programs and Features
3. Go to Turn Windows features on or off (requires a UAC authentication if you don't have UAC turned off.)
4. Click the check box next to Telnet Client
5. Hit OK
6. "Please wait while the features are configured. This might take several minutes."
7. No, really, it takes a minute
8. Enjoy. May I recommend telnetting to towel.blinkenlights.nl for some ASCII Star Wars love?
Edit: Current Windows 7 Betas behave in the same manner.
I'm going to step aside from my normal patching discussions and talk about what happens when you do get attacked with malware that exploits a vulnerability. When a nasty program exploits an unpatched vulnerability, there are always mitigating factors that can help limit the impact. One of the big ones is that the exploit usually runs in the security context of the account which it attacks/is run against. Security vendor BeyondTrust looked at the 154 Microsoft vulnerabilities published in 2008. They found that 92% of all vulnerabilities had their impact mitigated or were rendered completely harmless when the user was running with no elevated privilege (normal user rights). Obviously this is a report from a security vendor selling software that helps manage user rights... but the breakdown for 2008 is striking, indicating that running as non-administrator at least mitigates:
- 94% of Microsoft Office vulnerabilities reported in 2008
- 89% of Internet Explorer vulnerabilities reported in 2008
- 53% of Microsoft Windows vulnerabilities reported in 2008
That makes sense when you realize that the first two categories are just applications. They're very specialized, widespread and extensible applications, hence the risk. Ultimately, however, they're running at the user's privilege level. Even though the OS itself is somewhat less protected-- many of the juicier exploits will run at the System context or elevate privileges-- 53% mitigation is still pretty good.
Here's my beef with Microsoft in this regard. We all know that running in the least level of privilege is the safest and these numbers add good ammunition to that argument. While Microsoft has made great strides in allowing the user to elevate their privilege on some actions in the "XP era" and later, getting the ability to universally change security context on the fly eludes them. *nix with sudo and the standard GUI security elevation method of OS X both have serious problems, but they're a lot closer to right. Windows 7 will certainly continue the slow progress in this area, but at some point Microsoft ought to do better.
Windows 7 is moving along swimmingly (that's a betta splendens joke, son.) The good news that that the beta version that we have out currently is the only real beta we're going to get. RC1 be the next release. A mid-2009 release looks increasingly do-able with a late Q2 timeframe not out of the question.
The bad news is that Windows 7 will be coming in 6... editions that is. Things to note:
- Home Starter is a gimped edition allowing only 3 concurrent applications, similar to XP starter edition. This time, however, it'll be a worldwide OEM only release. Expect this version to ship on Netbooks, possibly including in developed countries.
- Home Basic is now for emerging markets only, but will look a lot like Vista Home Basic -- unlimited concurrent aplications but no Aero Glass, no "advanced multimedia" features and limited local area networking support.
- Home Premium is largely similar to Vista Home Premium in feature content with the main limitations being ones relating to remote access, joining a domain, EFS etc. This version will be available worldwide.
- Professional is the "intro" business class OS, with the ability to join a domain, use EFS, etc.
- Ultimate is again the ultimate home/business solution, and the best license that you can buy individually. Ultimate adds BitLocker, AppLocker, etc.
- Enterprise is available only as a volume license, and includes most of the same features that Ultimate does, plus deployment and management-centric tools.
At least it's no worse than Vista, but whomever thought limiting an OS to three concurrent apps should be shot repeatedly at close range. I'll be a sad panda if this version really starts infecting computers I have to touch.
This is going to be short as it's already covered well elsewhere and this is late... Microsoft has another out-of-band patch as of 12/17, MS08-078 affecting all versions of IE on all supported OSes except Server 2008 for IA-32/x64. Zero-day exploits are already going on. Get this one patched ASAP.
I'd normally say "use Firefox" or some other browser whenever possible, but Firefox and Opera are also currently suffering vulnerabilities. Firefox 3.0.5 resolves the issues. While not quite as sever as the zero-day exploit on IE, these are noteworthy as cross-platform.
GeekSmack has apparently found somebody willing to brave the wrath of Microsoft's lawyers, and broken cover with a video of Windows 7's boot screen. This doesn't really show much besides a slicker animation than Vista, but it does indicate serious progress if they're already tweaking the "nice to haves" vs. the core changes and updates.
Betas of Windows 7 are likely to be released in January, so a 2009 timetable for Windows 7 is starting to look a lot more likely.
Well, the product that started as Blackcomb, then codename Windows 7 will officially be called... (drum roll please)... Windows 7!
Never mind that it's a lot closer to a "6.1" version, this may mark the return to relatively sensible version naming at Microsoft.
Coincidence that Nehalem has been named i7? Windows 7 on i7? Sounds like a match made... somewhere.
Posts
