skip to main |
skip to sidebar
Ever want to prevent a user from attaching a USB drive? Well, you could turn off USB in the system BIOS, but that prevents attachment of all USB devices, not just drives. That could be disastrous if you don't have a PS/2 Keyboard and Mouse attached.
There's a simple registry hack that manages how Windows XP SP2 and later and Vista manage attached drives (including external hard drives as well as flash) but not prevent the use of HID devices and other non-drive devices. There's a very good write-up on the How-To Geek. The hack can be summed up in this simple line:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
"WriteProtect"=dword:00000001
For more security, you can look at physical protection. Unfortunately the USB physical standard doesn't allow any realistic way to permanently lock the drives, but you can block them. Lindy makes USB port blockers that will at least deter casual attempts to plug in USB and at least slightly slow determined users. They can be removed with a carefully bent paper clip, but once in, you can't easily remove with bare hands. Different colors use different keys to remove. Of course, you can buy them in colors other than pink...
Telnet is bad, mkay? It's insecure. I get it. Everything goes in plaintext totally in the clear. However, it's still a useful tool. Vista (including Ultimate) apparently feels that such a powerful tool should be hidden away from prying eyes and doesn't install it by default.
To install the Microsoft telnet client, do the following:
1. Go to the Control Panel
2. Open Programs and Features
3. Go to Turn Windows features on or off (requires a UAC authentication if you don't have UAC turned off.)
4. Click the check box next to Telnet Client
5. Hit OK
6. "Please wait while the features are configured. This might take several minutes."
7. No, really, it takes a minute
8. Enjoy. May I recommend telnetting to towel.blinkenlights.nl for some ASCII Star Wars love?
Edit: Current Windows 7 Betas behave in the same manner.
I'm going to step aside from my normal patching discussions and talk about what happens when you do get attacked with malware that exploits a vulnerability. When a nasty program exploits an unpatched vulnerability, there are always mitigating factors that can help limit the impact. One of the big ones is that the exploit usually runs in the security context of the account which it attacks/is run against. Security vendor BeyondTrust looked at the 154 Microsoft vulnerabilities published in 2008. They found that 92% of all vulnerabilities had their impact mitigated or were rendered completely harmless when the user was running with no elevated privilege (normal user rights). Obviously this is a report from a security vendor selling software that helps manage user rights... but the breakdown for 2008 is striking, indicating that running as non-administrator at least mitigates:
- 94% of Microsoft Office vulnerabilities reported in 2008
- 89% of Internet Explorer vulnerabilities reported in 2008
- 53% of Microsoft Windows vulnerabilities reported in 2008
That makes sense when you realize that the first two categories are just applications. They're very specialized, widespread and extensible applications, hence the risk. Ultimately, however, they're running at the user's privilege level. Even though the OS itself is somewhat less protected-- many of the juicier exploits will run at the System context or elevate privileges-- 53% mitigation is still pretty good.
Here's my beef with Microsoft in this regard. We all know that running in the least level of privilege is the safest and these numbers add good ammunition to that argument. While Microsoft has made great strides in allowing the user to elevate their privilege on some actions in the "XP era" and later, getting the ability to universally change security context on the fly eludes them. *nix with sudo and the standard GUI security elevation method of OS X both have serious problems, but they're a lot closer to right. Windows 7 will certainly continue the slow progress in this area, but at some point Microsoft ought to do better.
Windows 7 is moving along swimmingly (that's a betta splendens joke, son.) The good news that that the beta version that we have out currently is the only real beta we're going to get. RC1 be the next release. A mid-2009 release looks increasingly do-able with a late Q2 timeframe not out of the question.
The bad news is that Windows 7 will be coming in 6... editions that is. Things to note:
- Home Starter is a gimped edition allowing only 3 concurrent applications, similar to XP starter edition. This time, however, it'll be a worldwide OEM only release. Expect this version to ship on Netbooks, possibly including in developed countries.
- Home Basic is now for emerging markets only, but will look a lot like Vista Home Basic -- unlimited concurrent aplications but no Aero Glass, no "advanced multimedia" features and limited local area networking support.
- Home Premium is largely similar to Vista Home Premium in feature content with the main limitations being ones relating to remote access, joining a domain, EFS etc. This version will be available worldwide.
- Professional is the "intro" business class OS, with the ability to join a domain, use EFS, etc.
- Ultimate is again the ultimate home/business solution, and the best license that you can buy individually. Ultimate adds BitLocker, AppLocker, etc.
- Enterprise is available only as a volume license, and includes most of the same features that Ultimate does, plus deployment and management-centric tools.
At least it's no worse than Vista, but whomever thought limiting an OS to three concurrent apps should be shot repeatedly at close range. I'll be a sad panda if this version really starts infecting computers I have to touch.
And this time, it's bringing a worm. At this point, the estimate of infected systems is at around 8 million according to F-Prot. I've not seen an infection yet myself, knock on wood, but considering:
A.) That there was more than enough warning with Microsoft flailing their arms over a serious out-of-band patch on 10/23/2008, plus at least one, probably two Patch Tuesdays since the patch was released.
B.) This worm only spreads over corporate and local networks -- networks that are supposed to be managed by professionals.
The numbers are disheartening to say the least.
--
Edit: Microsoft has a helpful portal for this worm. Ars Technica also has a great article, quoting an infection rate of around 1.1 million PCs for the last 24 hours.
I know this seems like a mundane task that most of us are admonished to do on a regular basis, but it really does need to be repeated: Blow your computers cases out once in a while, especially if they get dusty.
We all know that heat sinks and fans lose their effectiveness when dusty leading to potential overheating, but there's a worse possibility. I ran into a system last week that had dust bunnies in it-- nothing out of the ordinary, except that one of them had lodged itself into the video card's tiny fan. The user reported a blue screen indicating video driver failure. I was busy and asked him to reboot since this was a first time thing. He came back shortly after reporting that it happened again, and now the system couldn't POST. A single dust bunny had lodged in a tight fan, causing the fan to jam, burning out the motor. The video card (a Quadra, unfortunately) then overheated to the point of death. Odd stuff like this can absolutely happen, without showing general signs of overheating.
To be fair, the opposite is true. It's possible you might dislodge some conductive dust which might land in an inopportune spot, causing problems. That can typically be fixed pretty easily with a second cleaning. A burnt out video card, northbridge, etc. can be a lot more costly.
For all of you guys out there tasked with migrating users from a previous authentication domain (or workgroup) to a new domain know that when a user logs in with the new credentials, a new profile will be created and all of the user's previous settings and files will remain in the old profile.
You can go in after the fact and clean this up or use some other tricks (like using the FAST wizard, treating the old profile as the old computer and new profile as the new) but I've found something faster. I'm probably boneheaded for not hearing of this sooner, but I did a 7k workstation migration at an old job and they never tried anything this simple and relatively foolproof.
Go into Documents and Settings (typically on c:) and locate the Default User profile. It's hidden with stock XP settings, so you need to turn on the option to show hidden files and folders. Under normal circumstances, this profile gets stamped out as a template for new users. You can twiddle with this to make bulk changes to new users, but we'll use it for a slightly more nefarious purpose.
Go ahead and back up Default User, as we'll be replacing the entire profile. You never know-- you might want it later.
Take the user's existing profile and copy it, renaming it as... you guessed it, Default User.
Now go ahead and perform your domain migration. Upon first login, the user's old, familiar profile will 'stamp' itself into the new one. The only 'gotchas' are that you can only do this for one account per computer and if your users have limited drive space and large profiles, you might run short on hard drive space with essentially 3 copies of the profile hanging out there. Still, this is a very easy migration method, and you can remove the old copies once you're sure the user is happy with the migration.
This should work just fine on Windows 2000, and I assume Vista as well. I just haven't tested it.
GeekSmack has apparently found somebody willing to brave the wrath of Microsoft's lawyers, and broken cover with a video of Windows 7's boot screen. This doesn't really show much besides a slicker animation than Vista, but it does indicate serious progress if they're already tweaking the "nice to haves" vs. the core changes and updates.
Betas of Windows 7 are likely to be released in January, so a 2009 timetable for Windows 7 is starting to look a lot more likely.
It appears that at least two credible variants of worms based on the MS08-067 exploit have gone live.
I'm fully (and I do mean fully patched) and your organization should be too.
I don't normally beat the dead horse with Windows patch news, but this one is bad. Microsoft released an out-of-band patch this morning with MS08-067.This vulnerability affects all current shipping Windows versions, with worm-style propagation being a very real likelihood. Versions of Windows 2000 and XP Pre SP2 are highly vulnerable, with some XP SP2+ and Windows Server 2003 systems being exploitable under certain common/popular firewall conditions.
Vista and Server 2008 appear to be exploitable, but only in terms of a DDoS type attack. Remote Code Execution has not yet been shown on a Vista system.
As of 12:30 PM Pacific Time, Microsoft reports attacks in the wild. This could be the next Blaster/Sasser type attack, so get patching!
Well, the product that started as Blackcomb, then codename Windows 7 will officially be called... (drum roll please)... Windows 7!
Never mind that it's a lot closer to a "6.1" version, this may mark the return to relatively sensible version naming at Microsoft.
Coincidence that Nehalem has been named i7? Windows 7 on i7? Sounds like a match made... somewhere.
Download Squad had a great article recently listing 24 open-source, free tools for admins and technicians. I'm already sold on PuTTY, DBAN, Memtest86/Memtest86+ and 7-Zip, but there are some real gems out there that I hadn't even heard of.
WCD in particular scratches an itch I've had since giving up Norton ncd many a year ago and being spoiled by locate under *nix. You do need to know how to manually set a Path variable, but otherwise it works as advertised.
They did have one recommendation that is good, but I think you can do better... Visualization tools for data are invaluable in giving you a meaningful picture (literally) of what is and is not taking up space. They recommend a product called WinDirStat.
WinDirStat looks like a re-working of the same concept that was pioneered by SequoiaView: "Cushion Treemaps" to visualize data. The strength of this method is that it can show individual files and folders easily by size and type, and groups them together, but the weakness is that it lacks a true hierarchical view. It's also a very busy interface which makes it hard to tell usage in terms of rough percentages or amounts. Unfortunately, SequoiaView lacks any type of obvious licensing. You're probably safe to use it for any purpose, but it's not OSS. It's also rapidly aging, so WinDirStat looks like a great replacement.
There are times when it is the best tool for the job, but for a first-pass on a Windows system I prefer an application called Scanner, written buy a guy named Steffan Gerlach. The licensing is also unclear, but presumed freeware with the source supplied. This app has the strength of being able to show disk usage as a pie chart, with a hierarchical view. It lacks color coding by file and doesn't show individual files at all until you drill down into that directory. It is, however, nice and portable, so you can run it from a USB drive or a network share.
Between the two, you should have pair of complementary products that'll allow you to better manage your storage.
Posts
