Security (MS)

It looks like a lot of applications don't sanitize/validate their Uniform Resource Identifier (URI) data coming in from other programs. First victim was the firefoxurl URI handler, and now it looks like the Trillian AIM URI handler is next.

Read about it more here. I suspect we are going to be seeing a lot of exploits and exploitable programs unfold in the following weeks, unfortunately.

I don't know the inner details of the URI passing mechanisms but it seems to be a mix of design oversight and programs not validating their input. Expect a lot more fingerpointing.

A good guide on planning your 'attack' on malware in a Microsoft environment.

To quote the overview:
"This guide is intended for IT Generalists who want information and recommendations that they can use to effectively address and limit malware that infects computers in small- and medium-sized organizations. This guidance provides a set of tasks that licensed Windows® users can perform at no cost to create the Malware Removal Starter Kit. Recommendations for free malware-scanning tools are included. You can use these tools in combination with the kit to conduct scans, detect problems, and remove malware from your computer."

Download and read about it here.

A good centralized location to learn about planning, deployment and troubleshooting FCS.

As a sidenote, there is an upcoming TS certification for Forefront Client and Forefront Server (70-557) that will be soon out of beta. If you are familiar with the older Antigen products, and especially the newer rebranded versions for Exchange 2007 and Sharepoint 2007, you already have a headstart on that certification. As always, I highly recommend the premade VHDs that are available from Microsoft's website to get familiar with the whole product line.

Do not confuse Forefront Client Security and Windows OneCare - they are not the same. FCS is lightweight enough that I put it on my demo VHDs. OneCare tends to 'take over' too many aspects of the operating system for me to use on VHDs.

Another aspect of FCS that many people either do not know about or are misinformed about - you can run FCS on client machines without a 'home' server if you want. It makes it particularly useful when you don't need or want all the reporting services. It is just a matter of deploying the client with "clientsetup.exe /nomom".