Witty Worm Targets Black Ice users

This is another new twist with the a Netcraft: Witty Worm targeting Black Ice users. What's nasty about this particlar attack is that it also can disable a machine. The way it does it means you can be infected and sugger damage long before you really become aware you have an issue.

Just more proof, as if it's needed, that users need to keep bang up to date and that defense in depth is a useful strategy. I suspect a lot of home users will get stung by this, and won't even know how it happened.

ISO Recorder Power Toy for XP

The ISO Recorder Power Toy is a cool tool written by MVP Alex Feinman. It allows you to read and write ISO images to/from CDs. Thus, you can grab an ISO image of a CD, store it on a disk, and later burn the ISO image. A simple tool - but most useful.

Sadly, this tool does not work on Windows Server 2003, which has updated the CD burning facility. The tool only works on Windows XP.

InfoWorld says Microsoft is to delay SQL Server, Visual Studio upgrades

In an on-line article, InfoWorld are reporting that Microsoft is to delay the launch of SQL Server Yukon and Visual Studio Whidbey. The delay, according to Infoworld will be till the first half of 2005, a delay of as much as 6 months. It looks like there will be an additional beta cycle for Yukon, which accounts for this delay. It remains to be seen what impact this delay will have on other products that are depending on Whidbey (for ASP 2.0) and on Yukon (e.g. SPS, CMS, CS).

Virtual PC 2004 vs. VMWare 4.0 Performance

I'm a real fan of VMware and VPC - I love what you can do with these tools. I've always felt VPC was slower, but this performance review demostrates it.

MyDoom.b - even smart people do dumb things

I've just had some email regarding the latest internet worm. One was from someone I know telling me his brother had just become infected and the other was from Microsoft getting the word out about this wom. I'd have ignored the second mail, had I not got the first one.

Basically, what is clear by this virus/worm is that even smart people can do dumb things at times. With that in mind, I have no hesitation in passing on the advice I got from MS. If it helps just one person, its worth.

So why not take a quick peek at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/alerts/mydoom.asp.

MBSA 1.2

MS has today announced a new version of Microsoft Baseline Security Analyzer (MBSA).

This new version provides better language (ie non-American!) support, plus support for Exchange 2003, MS Office, Microsft Java Virtual Machine, B iztalk, Commerced Server, Contene Management Ser ver and Host Integration Server, MSXML, MDAC. MBSA solves a number of other problems too!

A useful upgrade, but where's SUS 2, MSI 3, etc??

Using Adminpak.msi to Install a Specific Server Administration Tool

In Windows 2000 (and 2003!) you can install the MMC snapins on your computer by runing adminpak.msi. One question that I've seen, but never managed to work out was a simple way of adding one, but not ALL the snapins. It turns out that it's not all that difficult, according to KB article 314978 - How To Use Adminpak.msi to Install a Specific Server Administration Tool in Windows 2000.

The format is not overly friendly. For example, to install the DNS console, you'd type:

msiexec /i adminpak.msi ADDLOCAL=FeDNSConsole /qb

Cool .NET Linking Tool

Now this little tool: Remotesoft's Salamander .NET Linker is pretty cool. It allows you to link .NET assemblies, including system files, into a single file. Once linked, you can deploy your applu without installling the whole .NET Framework.

The tool links MSIL code on demand putting together only the required classes and methods. The tool then builds a minimum set of the Microsoft .NET runtime to ship with your application. This usually results in installation size substantically smaller and faster then traditional .NET apps.

And by linking them this way, it's easier to obfuscate the code. A neat tool!

NetMon 2.1 - Part of SMS 2003

One of the less trumpted components of SMS 2003 is an update to Network Monitor. SMS 2003 now ships with NetMon 2.1. I'm still delving into to find the differences. But the one difrerence I really like is in the network selection dialog. Instead of putting up the card's MAC address - the name of the connection is shown. Finally!

Microsoft TechNet Events

Microsoft UK provide a great deal of free technical information for IT Professionals (MCSEs/MCSAs, etc), under the banner of TechNet. UK TechNet events are meant to convey technical information to IT Professionals. TechNet events include evening seminars, road shows and Web Casts. Personally, I love the evening events at Microsoft's Headquarters in Reading: cold beer, warm pizza, and good sessions.

I was able to give some of these events in 2003 (and will be giving more in 2004). In December, I gave a talk on patch management and SUS. You can get a recording of this session athttp://www.placeware.com/cc/emea/view?id=msft0912cs&pw=RMG9GT. This uses PlaceWare, so to see the full webcast, you will need to load some software (you will get prompted for it).

The overall UK technet site is http://www.microsoft.com/uk/technet/learning/ - enjoy!

Thomas

Details on XP SP2 Emerge

Microsoft have started releasing details on what XP Service Pack 2 will look like. All 73 pages worth!

Most of this document describes details of what has previously been disclosed. The details are nevertheless interesting reading!!

Making the AU client run a little more often

I've been doing a few presentations on Patch Management (see http://www.reskit.net/sus for the slides and pointers) and got asked an interesting question relating to the speed by which an Automatic Update client can request updates from a Software Update Services (SUS) server.

The client is hard coded to go to a server every 22 hours (less a random amount of up to 20%). Thus in 'steady state' each clinet will ask for updates every 17.6 to 22 hours. But what if you want to push out an update a bit faster how can you do it? Turns out there are 2 ways - neither of them very pretty. GPO Workaround

1. Assign a temporary GPO to the appropriate part of the Organizational Unit structure and use security filtering to ensure it applies to the appropriate computers.� Note that this temporary SUS GPO should be of a higher priority then the SUS GPO which is normally in use.�

2. The policy settings within this GPO should be configured to disable the AU client and change the default Group Policy refresh interval for computers to 5 minutes.

3. Force DC replication to occur so that all domain controllers have a copy of the new group policy object.

4. Wait up to 120 minutes for all clients within the OU to refresh Group Policy (default GPO refresh time for domain members is 120 minutes).

5. Amend the policy settings within the new GPO policy so that the automatic updates client is enabled and set to automatic download and automatic installation. Automatic installation should be set to occur 1 hour from the current time.

6. Force DC replication to occur so that all domain controllers have a copy of the changed group policy object.

7. Wait for all the SUS clients to refresh the updated SUS GPO settings (which is now happening 5 minutes).� Once the GPO takes effect, the automatic update clients should begin to download the new update from the SUS server. Installation will begin once the specified time is reached.

8. Once the update has been successfully installed on all target computers, delete the temporary GPO used to make all these changes. Servers will fall back to the existing AU download and installation options once they refresh their Group Policy settings.

----------- Net Stop/Start method

1. From the cmd.exe prompt: net stop "Automatic Updates"

2. Delete HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\LastWaitTimeout (if it exists)

3. Delete HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\DetectionStartTime (if it exists)

4. Make sure that HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\AUState=0x2

5. Net Start "Automatic Updates"

Lindows.com Ordered to Change Name in Europe

PC World reports that PCWorld.com - Lindows.com has been ordered to Change Name in Europe. The US case is still ongoing, but judges in both Finland and Sweden have given Microsoft an early Christmas gift.

Another Internet Explorer Vulnerability

The latest Internet Explorer URL Spoofing Vulnerability, reported by Secunia. This is nasty - as it allows IE to show an arbitrary FQDN in the address bar, which is different from the actual location of the page. Thus, you might see "www.microsoft.com" in the address bar, yet IE is actually trying to render "www.badsite.XXX".

While most folks reading this will not be likely to get hit by such tricks, the average user may well be. Let's get the patch for this, and get it applied quickly!

The Annotated XML Specification

I've been trying to learn more about, inter alia, XML and XML Web Services. I came across an interesting web page - The Annotated XML Specification, which is what it says, an annotated XML spec. The annotations have been written by Tim Bray (who was a co-editor of the Spec).

Many fine hours of reading ahead!

Windows SharePoint Services - Installation is Interesting

We all goof - and I'm not alone in being guilty of it. But the issue highlighted in KB article 833019 is beyond a goof. And the complications it can generate in some installations are a worry!

The problem occurs if you install Microsoft Windows SharePoint Services (STS as it used to be called), which from 3 days ago, fails with a fairly obscure error message. You also get this problem if you try to provision a new virtual server or you try to create a new content database when you are running Windows SharePoint Services by using MSDE (the KB appears to be inaccurate on this point).

The error is caused by a bug in the code that verifies the signatures of DLLS installed with SPS. All installations of Windows SharePoint Services experience this behavior after November 24, 2003. And guess which product installs this component by default? Small Business Server. Ouch!

Problems hapen. But the workaround is interesting: Set the date in the Date and Time Properties dialog box to a date that is between May 24, 2002 and November 23, 2003. That's right, lie to the OS. Trustworthy computing, maybe not, but it works. OH, be careful to not set it too far adrift, or you might trigger product activation.

My view of WPA is further diminished.

And here I thought Linux was secure!

PC World reports that Servers belonging to the Open Source Debian project were hacked. It suggests that there was no impact on the software update issued last Friday. Debian's site carries more information about the attack.

This attack comes close on the heels of both an attempt to hack the Linux kernel, and and an attack at the Free Software Foundation. These hacks show two things: First that security is everyone's problem (not just for customers of Microsoft) - attackers do not play by any rules and will attack pretty much anything that is not totally locked down. Second, it proves, yet again, that any OS can be installed insecurely.

What the Linux bigots often fail to remember is that security requires three things: people, processes, and technology. Even the most secure technology can be defeated by poor processes or by people not doing the right things. This is not a Microsoft vs Linux thing, but more a simple recognition that security of your systems is only as strong as the weakest link.

Dell Ditch India - and not before time

According to CNN.com Dell is cancelling their Indian tech support. I've recently had the misfortune to have had to make 2 calls to this center and they were both awful. My trusty laptop (a Dell Latitude) had it's hard disk begin to go. I needed an urgent replacement as I was using the laptop to present sessions at IT Fourm.

Both techs I talked to were cheerful, but the responses bore no relationship to my questions. They had a script and totally had to follow it - any deviation was met with a refusal to go further. It took forever, and in the end, they were unable to help in time - so I go another hard drive from another source and made do with that. Next week, when I settle down a bit, I'll call again and get the disk replaced. See CNN.com for full details of this story

I couldn't make this stuff up if I tried!

Only an American could make a soft drink flavoured with turkey and gravy (so awful, even its creator admits is undrinkable) and sell out. See BBC NEWS | Business | 'Gross' turkey tipple gobbled up for the details.

Microsoft Announces Availability of Open and Royalty-Free License For Office 2003 XML Reference Schemas

I was in Copenhagen last week at IT Forum. I was co-presenting sessions on Microsoft and Shared Source, in which we looked at how MS viewed Open Source, Linux, and all that. One issue that was raised was over file formats - one thing that seemed to be wanted by customers was an open XML schema for Office documents.

As it turns out, MS also formally used Copenhagen and IT forum to announce the availability of Open and Royalty-Free License For Office 2003 XML Reference Schemas.

This is a good step forward!