Archive for April, 2008

OneCare Cleanup Utility and other OneCare tools

Posted by Mark Raborn in PC Health on 2008/04/25

OneCare is an all in one computer care product created by Microsoft. For the Administrator, there are some special tools relating to OneCare we should know about for our toolkits.

please read on for more information…

All in one computer care describes a bundle of products packaged together to protect, secure, oversee, backup, restore and advise users about their computer systems. OneCare is one of these suites. It is a *wonder* of modern computing and offered (in addtion to competitor’s suites) in a market where software suites are becoming able to heal and care for our computers.

OneCare is a very good product. Personally, I highly recommend it. I have been testing and using this product since before it’s 1.0 release and now (at the 2.0 release), it is a truly mature product.

As with any firewall, malware, spyware product, OneCare generally needs to be in sole command of PC secuirty. It does not easily share it’s real estate with other Security/Malware type programs. If there are competing products installed when you sit down to install *any* PC Security Suite, it is best to remove the previous one completely before installing the one of your choice.

The tricky part with OEM machines (i.e. machines built by manufacturers such as DELL, Hewlett Packard, Sony, Toshiba) is that some of the manufacturers install security and protection software that may not be seen by the user (or at least…. not obviously seen). Manufacturers can install their own PC security software prior to shipment. Although, this is an attempt by the manufacturer to simplify the user experience or help the user in some way (such as adding security features), it often does not turn out that way.

The short story is that with certain manufacturer software in place, the installation of a PC Security Suite (such as OneCare) can fail. If it does fail, sometimes an un-installation is necessary of the PC Security Suite you were trying to install. That is where the tools above come in very handy for OneCare. Here they are again:

ONE CARE DOWNLOADS

If you do run into an issue, and that issue is severe enough to prompt you to uninstall OneCare, the OneCare Cleanup Utility will help you do that.

The next step (given our example) would be to research your PC to discover just how the manufacturer’s software may be affecting the installation, turn off – disable - uninstall the features in the manufacturers software that are causing the OneCare installation to fail and then…. reinstall OneCare.

You can get help from us here at WIGITAL

You can also follow this blog post at the OneCare Live Space to contact OneCare support and learn more about the specifics of getting help with OneCare.

http://windowsonecare.spaces.live.com/Blog/cns!C29701F38A601141!4866.entry

Will write more on PC Health soon.

Thank you for reading.

Contact us at WIGITAL if you have needs or questions about computing. We’re here to help.

No Comments

ISA Server Windows Update Fails

Posted by Mark Raborn in ISA on 2008/04/22

Windows Update with ISA 2006 and ISA 2004

KNOWN ISSUE: there is a known issue with updating ISA Server 2006 using Windows Update after initial installation. Microsoft has written brief suggestions on this subject. However, a search of the internet will reveal that this issue is a stumbling block for many people.

Although there is a mixed bag of solutions offered on the internet, I have found the key to be a combination of practices:

  1. creating a NEW Firewall Policy Rule
  2. auditing the Domain Name Sets and applying the corrections to the new rule (i.e. using the correct Domain Names)
  3. adding a URL set to the new rule (and using the correct URLS)
  4. and auditing the ISA System Policy | Various Configuration Groups | Allowed Sites (and using correct sites names)

One confusing aspect of troubleshooting this issue with ISA Server and Windows Update is that part of the work has already been done. Microsoft attempts to solve the issue in the design of ISA itself. There are some incomplete pieces in place that need to be cleaned up. ALSO, solving Windows Update issues with ISA 2006 or 2004 is a matter of recognizing that most articles you will read that are written to address the issue list only part of the solution. So, lets walk through the part(s) shall we :)

CREATING A NEW WINDOWS UPDATE FIREWALL POLICY RULE USING DOMAIN NAME SETS IN ISA 2006

Microsoft has provided the first hint here…

  • Access Rule for Windows Update in ISA 2006

    • This article points out that a new Access Rule needs to be created and that it should point at a Domain Name Set (allowing domains within the set to be accessed). What it DOES NOT CLEARLY DEFINE is what domains should be in the set!

    Follow the article as written AND add these domains to the Domain Name Set by going to Firewall Policy | Toolbox | Domain Name Sets | Microsoft Update Domain Names and adding these domains

    *.download.microsoft.com
    *.download.windowsupdate.com
    *.update.microsoft.com
    *.windowsupdate.microsoft.com
    download.microsoft.com
    download.windowsupdate.com
    update.microsoft.com
    windowsupdate.microsoft.com

    CREATING A NEW WINDOWS UPDATE FIREWALL POLICY RULE USING URL SETS IN ISA 2004

  • Windows Update Version 6 Web site through ISA Server

    • This article points out that a new Firewall Rule needs to be created but this time the suggestion is to use URL Sets (allowing specific http://URL’s to be accessed). What the article DOES NOT ACCURATELY DEFINE is what URLS should be in the set!

    There are 2 places to look in this article: Scenario 2 and Scenario 4 . Scenario 2 hints at the URL’s that the editors suggest should be used (please note I believe this URL list to be outdated). Scenario 4 provides a walk-through on creating a Firewall Rule to make use of a URL Set but does not define URLs completely!

    Follow the Scenario 4 portion of the article as written AND add these URL’s to the URL Set by going to Firewall Policy | Toolbox | URL Sets. My choice was to create a new URL Set with the following URL’s added to the list (NOTE: the syntax here is VERY IMPORTANT)

    http://*.update.microsoft.com/*
    http://*.download.microsoft.com/*
    http://*.download.windowsupdate.com/*
    http://*.windowsupdate.microsoft.com/*

    The key is not to bank your money on the list offered in Scenario 2. Although some of the sites they offered are accurate, some are outdated and the list does not implement the potential wildcards ( * ) required to accommodate all combinations of URL’s. Although, not exhaustive, the above list does work currently with http://update.microsoft.com (as of 2008-04-22).

    UPDATING THE BUILT IN SYSTEM POLICY ALLOWED WINDOWS UPDATE SITES ISA 2004 AND ISA 2006

    Oddly enough, ISA Server has a built in set of Allowed Sites that are designed to solve the Windows Update issue right out of the box. In other words, it’s supposed to be fixed before it’s broken. Microsoft designed an element to allow Windows Update access (by including key Microsoft sites as part of the install). The challenge is THE SITES ARE NOT ACCURATELY DEFINED to allow access with the default install!

    Go to Firewall Policy | Tasks | System Policy Tasks | Edit System Policy. This will bring up the System Policy Editor. Scroll to the bottom of Configuration Groups. Under Various, click on Allowed Sites. Now, on the [tabs] on the left, CLICK on the [To] tab, SELECT System Policy Allowed Sites and CLICK Edit… These *Allowed Sites* are intended to provide access to Windows Update, microsoft.com/downloads, and other key Microsoft resources (by default!). Let’s check the Sites and confirm the following are present:

    *.download.microsoft.com
    *.download.windowsupdate.com
    *.update.microsoft.com
    *.windowsupdate.microsoft.com
    download.microsoft.com
    download.windowsupdate.com
    update.microsoft.com
    windowsupdate.microsoft.com

    That’s it folks :)

    OK…. with these aspects covered (3 different methods from the beginning of this article), we should now be able to go to http://update.microsoft.com and check for updates with ISA Server.

    If there are any remaining access issues, there is one more article to consult.

  • http://support.microsoft.com/kb/902093/ – How to read the Windows Update log file

    • Please read through this article carefully if you still are experiencing challenges. KB902093 provides a step by step walkthrough on how to read the Windows Update log file.

    My method (from the article) is go to Run and type

    %windir%\Windowsupdate.log

    Once the log comes up, scroll toward the very end. The point of failure for me (which helped me determine these URLS and DOMAIN NAME SETS) was where the local installation of Windows completed the analysis of the Operating System and then tried to synchronize with Windows Update. For you, no matter what the problem is…. simply look for points of failure in this LOG, identify the URL’s and DOMAIN NAMES that failed and return with this data to your lists above. Enter in your URL’s and DOMAIN NAMES and hopefully, your good to update :)

    Also, once your up and running, check out Best Practices Firewall Policy for ISA 2006 . It’s a good way to get off to a smart start with ISA.

    AND REMEMBER!!! none of this does any good if your BROWSER does not trust the sites. Make sure to add sites to your internet browsers list of trusted sites as needed. The list Microsoft provides in Scenario 2 of the Windows Update Version 6 through ISA article above is a good place to start. Here is their list if you need it.

    http://download.windowsupdate.com

    https://*.windowsupdate.microsoft.com

    http://*.windowsupdate.microsoft.com

    http://*.update.microsoft.com

    http://*.download.windowsupdate.com

    http://update.microsoft.com

    http://*.windowsupdate.com

    http://download.microsoft.com

    http://windowsupdate.microsoft.com

    http://ntservicepack.microsoft.com

    http://wustat.windows.com

    https://*.update.microsoft.com

    IN CLOSING

    Adding sites and setting up URL Sets and Domain Name Sets can be used for any sites on the internet. These same techniques will help you no matter where you want to travel with your browser.

    Thanks for reading :)

    ALSO: for corporate or small business security and network infrastructure, say Hi!. Call or emal us at WIGITAL. We are Business Technology People and we’re here to help.

    2 Comments

    Multiple Common Names for Certificates using selfssl.exe

    Posted by Mark Raborn in Security on 2008/04/22

    Securing IIS with SelfSSL.exe when Multiple Common Names are required

    Sometimes, you don’t find it in writing :)

    BASICS: Server Certificates are used to secure network traffic by encrypting the packets. This encryption can be achieved in a variety of ways. RSA Certificates are one of these ways.

    Common Names for RSA Server Certificates are used to identify the name of a Certificate to a User and their browser (Firefox, IE, Safari, etc…). This name helps the browser match a site with it’s correspondingly named certificate. If the names don’t match, the browser throws a warning message.

    Certificate names generally match the Domain name or IP address of the site. Example: http://www.wigital.net uses a Common Name in the certificate of www.wigital.net.

    Some websites have multiple identities (more than one name). When working with content published to these sites across different networks (intranet, extranet, internet, etc…), there can be a need to *name* a site differently for one network then it is named for another.

    EXAMPLE: One set of people might need access to a site with a local network name of (http://privatestuff.local) and another set of people might need access to the same site over the InterNetwork at (http://everybodystuff.com). In this example, different access permissions would be applied depending on how you access.

    Self signed certificate generation in IIS does not consider this need when you read the How To’s (aka. the manual). SO… LET’S MONKEY AROUND :)

    You can create multiple Common Names for a selfssl.exe generated certificate using a comma seperated list. The default synatx for selfssl.exe is:

    selfssl.exe /T /N:cn=everybodystuff.com /K:1024 /V:7 /S:1 /P:443

    in this syntax N:cn=everybodystuff.com is the Common Name (cn). So the common name then is *everybodystuff.com*

    Simply concatenating a series of common names (cn=???) seperated by commas will generate multiple common names for the certificate. Example:

    selfssl.exe /T /N:cn=everybodystuff.com,cn=privatestuff.local /K:1024 /V:7 /S:1 /P:443

    With this technique you can generate multiple common names in succession. There you go!

    NOTE: This technique is not *commonly* yuk-yuk-yuk needed as most sites use a single name. However, if you do a lot of intranet work you may find it useful on a local network where access to resources varies based on subnet, DNS naming and permissions.

    Thanks for reading.

    …. and, if you need services, contact WIGITAL about securing your network.

    4 Comments

    Exchange 2003 Publishing using Forms Authentication with ISA 2006

    Posted by Mark Raborn in Exchange on 2008/04/19

    ISA Server has some extraordinary functionality when it comes to securely publishing Servers and Web Servers in the Windows Domain.

    Today, I’m preparing to use this tool to securely publish Microsoft Exchange 2003 using Forms Authentication with SSL Bridging. Given the complexity of many procedures related to ISA, my experience is that Microsoft has done an excellent job of documenting ISA 2006 with walkthroughs. I have made references to TechNet , etc… for various pieces of the security puzzle. Much of this article is taken from their work. Thank you Microsoft.

    Also, Dr. Tom Schinder (as always) has outstanding walkthrough’s available at isaserver.org. Tom is one of the true community leaders in ISA – Internet Security and Acceleration Server.

    About the article: this data is being written for the reference of one of our clients. Since we are using the internet for our notepad, everyone may share the material, refer to it and borrow from it.

    TOPOLOGY

    • Domain Controller – Windows Server 2003
    • Exchange Server – Exchange Server 2003
    • ISA Server 2006
    • Windows XP and Vista client(s) – for testing
    • Windows Mobile 5.0 with Messaging and Security Feature Pack – for testing

    We are going to use ISA today to securely publish a single Exchange Server. To do so, we must assure that Microsoft Exchange 2003 is setup properly to provide Outlook Web Access, Outlook Mobile Access and Outlook via the Internet using RPC/HTTP. Please verify that:

    the WALKTHROUGH

    1. Setup ISA according to the requirements of the list above
    2. When naming ISA Server, do so as a Workgroup member (in this scenario we are not a member of the Domain)
    3. Create at least a 2 leg ISA configuration (requires two network adapters)
    4. Place the ISA Server outside the perimeter of your Network (as the edge firewall)
    5. Connect the ISA Server (WAN side) to the Internet in the IP subnet assigned to you by your ISP (you can multi-home an external facing ISA NIC – article here )
    6. Confirm Internet Connectivity from the WAN side network interface card (example: http://update.microsoft.com)
    7. CREATE A WEB LISTENER FOR MAILl
      1. Go to ISA Management Console
      2. Go to the Toolbox [tab] and expand Network Objects
      3. Right click the Web Listeners container and select New Web Listener…
      4. Enter a Web listener name: (such as OWA 2003 SSL with FBA) and click Next
      5. Under Client Connection Security select the radio button ( ) Require SSL secured connections with clients and click Next
      6. Under Web Listener IP Addresses select the checkbox [ ] for network to which this listener will be assigned
        1. this will enable the Select IP Address [button] below the networks selection area
        2. click Select IP Address [button]
        3. Under External Network Listener IP Selection select the radio button ( ) to Listen for requests on:
          1. If the selected Network has only 1 IP address assigned then select ( ) Default IP address for network adapters on this network
          2. If the selected Network has multiple IP addresses assigned (i.e. the Network Adapter is multi-homed) then select ( ) Specified IP address on the ISA serer computer in the selected network
          3. NOTE: once selected the IP’s will appearin the networks box
        4. Click Next ……
      7. Under Listener SSL Certificates, it is possible to Use a single certificate for this Web Listener OR to Assign a certificate for each IP address . Select the setting appropriate to your needs. Most oftern a single certificate for a each IP address is used as SSL is commonly enabled on a 1 to 1 ratio of 1 Certificate to 1 IP address
      8. NOTE: certificates are installed to the Personal certificate store of the ISA Server. This can be accomplished using the Certificates Snapin in the MMC Microsoft Management Console
      9. Authentication Settings
        1. Under Authentication Settings, from the drop-down menu Select how clients will provide credentials to ISA Server, choose HTML Form Authentication
        2. Under Select how ISA Server will validate client credentials: select LDAP (Active Directory),
        3. click Next
      10. Single Sign On Settings can be enabled by selecting the radio button ( ) Enable SSO for web sites published with this Web Listener and entering the domain name of your published resources that share the same first level domain. For SSO to work, the resources allocated for SSO must use the same Web Listener. To read more, please refer to Dr. Tom Shinder’s article. Please click Next
      11. Review your settings to complete the wizard. Click Finish
    8. INSTALL THE RPC/HTTP PROXY ON THE EXCHANGE SERVER
      1. On the Exchange Server, go to Control Panel
      2. Select Add or Remove Programs
      3. Select Add/Remove Windows Components
      4. Highlight Network Services and click the Details [button]
      5. Select the checkbox [ ] RPC over HTTP Proxy and click OK
      6. On the Windows Components page click Next
      7. you may be prompted for the Windows Server installation disk or Service Pack location
      8. when the Components configuration is completed, click Finish
    9. SET EXCHANGE 2003 AS BACKEND EXCHANGE SERVER
      1. Go to Exchange System Manager
      2. Under the Exchange Organization you are publishing, expand the Servers container
      3. Right click your Exchange server and select Properties
      4. Select the RPC-HTTP [tab]
      5. Select the radio button ( ) RPC-HTTP back end server
      6. NOTE: you may be prompted that there is no RPC-HTTP front-end in your Exchange Organization. Click OK
      7. Click Apply and Click OK
    10. CONFIGURE THE RPC PROXY SERVER TO USE SPECIFIC PORTS FOR RPC/HTTP
      1. NOTE!!! – THIS REQUIRES EDITING THE REGISTRY
      2. To to Start | Run | and type regedit.exe
      3. per Dr. Schinder: the following registry values are automatically configured during Exchange setup. Although you do not have to configure these registry values, you should verify that these registry values are configured correctly.
      4. VALUES – CONFIRM THESE
        1. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
          1. Value name: Rpc/HTTP Port
          2. Value type: REG_DWORD
          3. Value data: 0×1771 (Decimal 6001)
        2. KEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeSA\Parameters
          1. Value name: HTTP Port
          2. Value type: REG_DWORD
          3. Value data: 0×1772 (Decimal 6002)
        3. KEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeSA\Parameters
          1. Value name: Rpc/HTTP NSPI Port
          2. Value type: REG_DWORD
          3. Value data: 0×1774 (Decimal 6004)
      5. NEW…
      6. NEW SETTINGS – MODIFY REGISTRY TO CONFIGURE RPC PROXY SERVER TO USE SPECIFIC PORTS
        1. perform the following steps to configure the RPC proxy server to use specific ports:
          1. On the RPC proxy server, start Registry Editor (Regedit).
          2. In the console tree, locate the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\RpcProxy
          3. In the details pane, right-click the ValidPorts subkey, and then click Modify.
          4. In Edit String, in the Value data box, type the following information:
            1. NETBOISNAMEofExchangeServer:6001-6002;FQDNofExchangeServer:6001-6002;NETBIOSNAMEofExchangeServer:6004;FQDNofExchangeServerFQDN:6004;
          5. NOTE: To determine the NETBIOS Name and the FQDN Fully Qualified Domain Name of your Exchanger server Go to Start | Run | type cmd.exe | in the command windows type ipconfig /all
    12. Click Next….

    NOTES:

    • The root certification authority (CA) certificate for a CA that issued the server certificate on the published Web server needs to be installed on the ISA Server computer
    • ISA Server needs to resolve the FQDN that is used to create the certificate. The connection between the ISA Server computer and the Exchange front-end server will not be successful if ISA Server uses a different FQDN than the FQDN used to create the certificate
    • Limit access to authenticated users. If you do not limit access to authenticated users, as in the case when a rule allowing access is applied to all users, ISA Server will not validate the user’s credentials. When access is limited to authenticated users, ISA Server will use the user’s credentials to authenticate to the Web server according to the configured delegation method.
    • Microsoft recommends that you apply each publishing rule to all authenticated users or a specific user set, rather than selecting Require all users to authenticate on the Web listener, which requires any user connecting through the listener to authenticate
    • Disable Forms Authentication on the Exchange HTTP Virtual Server to permit ISA to act as the Proxy for Exchange Forms Authentication.

    NOTES ON LDAP PASSWORD CHANGE

    To configure the Change Password option when using LDAP authentication, LDAP needs to be configured with the following settings:

    • Connection to the LDAP servers must be over a secured connection. This requires an SSL certificate to be installed on the Active Directory servers. For more information about enabling LDAP over SSL, see “How to Enable LDAP over SSL with a third-party certification authority” at the Microsoft Support Web site.
    • The ISA Server computer needs to have the root certificate for the CA that issued the SSL certificate installed on the Active Directory servers.
    • Connection to the LDAP servers cannot be via a global catalog (it must be LDAP secure – port 636 by default~> a link with some info )
    • A user name and password (a custom Service Account) that is used for verifying user account status and changing passwords as required (when the ISA Server communicates to Active Directory).

    NOTES ON REDIRECTING CLIENTS TO THE SSL SECURED EXCHANGE VIRTUAL DIRECTORY

    The default setting in IIS for access to web sites, virtual directories, etc… is to do so over HTTP. Given that credentials passed over HTTP are in the clear, the use of Secure Socket Layer encryption should be considered *a must have* to improve network security for usernames and passwords passed over the Internet.

    Most users don’t consider typing https (the secure form of http). So, after SSL has been setup, the next step should be to consider that IF most users don’t habitually type URL’s in the form of https… something-something, then a REDIRECT might be useful to help them reach their destination securely to your OWA – Outlook Web Access domain name.

    • On the OWA Server, open IIS Manager
      • CMD – go to Run and type inetmgr.exe
      • GUI – Start | All Programs | Administrative Tools | Internet Information Services [IIS] Manager
    • Navigate the SERVERNAME (local computer) to the Web Sites node
    • Right-click the OWA Virtual Server (usually Default Web Site) and select Properties
    • Select the Home Directory tab
    • Under the setting The content for this resource should come from: select the radio button A redirection to a URL
    • Check the box A directory below the URL entered
    • Click OK
    • When prompted to confirm inheritance overrides, click OK
    • Restart IIS
    • more….

    Please note that this procedure should only be used when Outlook Web Access is the main web service provided to your users and the Default Web Site is NOT hosting other services and functionalities that require the use of the http:// Port 80 access at the web site root.

    ALSO: there is more than one way to achieve a redirect for OWA in IIS. For further study please read:

    Other Online Walkthroughs on Exchange 2003 and ISA 2006

    Guides

    For Troubleshooting see:

    No Comments

    UAC – User Account Control ( and my ipconfig )

    Posted by Mark Raborn in Windows Vista on 2008/04/05

    User Account Control – “The requested operation requires elevation”

    Boy… even simple procedures get a couple of added steps when you are serious about security.

    Note to self, sit down and do a little more reading on Vista!

    LINKS

    Administrators and Power Users who sometimes have to float around their department helping out with DNS, DHCP and the like have another step in the procedure chain when dealing with Windows Vista and ipconfig (or any other command/GUI based Administrative function).

    IPCONFIG is an old tool at the command line that is responsible for utility type tasks in configuring IP (Internet Protocol) such as

    • release - releasing an IP address
    • renew - renewing an IP address
    • flushdns - flushing out the Domain Name System resolver
    • all - seeing all the data relating to a particular network adapters current settings
    • etc…

    In the old days, you would open up cmd.exe , type in your ipconfig command and whalla !!! You’d get your information, network happy faces all round. It’s a little different in Vista, because of a new security feature called User Account Control.

    User Account Control keeps functions, applications, executables in the Vista computer from being executed with ADMINISTRATOR privileges. This is a makes sense approach and is practiced in most computing environments whether Linux, Mac, Windows, whatever. Plainly put this security practice says, DONT logon as the administrator and run everything as the administrator! If the bad guys were to get in… then they get in as the administrator

    In Windows XP and prior, Windows (Microsoft) suggested that you use this practice of least privilege by setting up TWO ACCOUNTS ~ (1) an every day regular computing account [a limited account] and (2) an account to use, only when needed, for the BIG BOY tasks (like Administrator type stuff).

    The difference today with Vista is that Microsoft is enforcing this practice in the Operating System itself. This addition to Windows Vista/Windows Server 2008 is called User Account Control.

    Unless you turn off UAC “User Account Control” (yes there is a switch to do this in Vista), then least privilege is enforced even when you are logged on as the Administrator. Personally, I often elevate privilege by using runas to launch a command line window within the context of the Administrator account. There is one little hitch in the giddee-up though… the command line does not elevate privilege that way that it once did using runas in prior versions of Windows.

    In Windows 2003 / Windows XP / Windows 2000 / keep going backward …. you could be logged in as a LIMITED user and launch the Start > Run > cmd.exe , re-launch another command window using runas Administrator, then any program you ran from that command line was “run as” the Administrator. This does not work in Vista. You can specifically instruct the OS to open a command line with elevated privileges (i.e. runas Administrator) and it will not allow you to do simple things like release and IP address. NO WAY buddy, sorry, not today :( .

    The funny thing is that you can do it with the mouse! Yes… RIGHT CLICK – Run as administrator. But using the command line runas command no longer achieves the same result.

    So… if you need to elevate privileges, and you are old school command line people, TRY USING YOUR MOUSE, you can right-click program Icon (and with Administrator credentials) you can runas and get back to work.

    I guess with Vista, that little cheese eating string tailed input device is really getting the VIP treatment. alas for my command windows: (To read more… visit this excellent article (with Pictures!) Administrative Privileges in Vista

    BTW… if this article is more of a headache then a help, and you’re looking for some relief, contact WIGITAL, that’s our company. We’re technology people and we do this stuff every day :) .

    Oh… and (personal opinion): overall, be thankful for these little inconveniences. They are keeping our networks “a little bit more secure” and our personal info “a little bit more our own”. Cheers

    , , , , ,

    No Comments

    Hidden Files and Alternate Data Streams

    Posted by Mark Raborn in Malware on 2008/04/01

    One of the most dazed moments in my computing past was the day I realized (from an issue with Roxio Easy Media Creator) that my computer was full of unseen data hitch-hiking on my files.

    I said to myself: “Self, uhh… _h_mm_mm_”

    Yes, it was a brief conversation but the point of my pondering was well taken, I needed to know more about hidden files, alternate data streams, malware, spyware, and I you-better-find-out-”ware”.

    Some years later, I still get the eebee-jeebee’s when I think how hackers potentially use the intracacies of the NTFS file system. It’s intimidating, no doubt about it. Fortunately at our company, we practice some aggressive network access protection policies, stateful packet inspection, etc… for our clients and we can scrub data when we have to. The challenge is helping clients and employees better understand some basics about data.

    Data is very much like a truck carrying a payload. You can see the nice bright sign on the side of the truck, you can waive at the driver and even recognize his “face”, but there is no way of really knowing what kind of cargo the vehicle is carrying unless you stop the truck, open up the cargo bay and look in the crates.

    So, for the purposes of better educating the public, and specifically my clients, I felt it helpful to post some links here for further reading. Some of it is a little heady but I believe it is well worth the time for a better education on the subject of Hidden Files and Alternate Data Streams.

    Please email or call me at WIGITAL if you have any questions. Thanks,
    Mark

    2 Comments