Aaron Tiensivu's Blog

To quote the horse from Ren and Stimpy from way back when, "No sir, I don't like it."
I'll keep it at that. Well OK, I will say one other thing. I'm glad my data isn't at the mercy of that device.
HP may make other good models, and who knows, maybe the ones I've seen are an oddity.

http://www.eff.org/Privacy/printers/docucolor/

Crazy stuff.
It is only a matter of time this is used somehow for forensics.

Useless fact of the night: Deleted files on a floppy disk is what lead to the downfall of the BTK killer. He had a bunch of church documents that he had deleted off the disk before he sent it into the press. Yes, they were Word documents. He thought he was really clever (or maybe he wanted to get caught) but almost everyone knows that when you delete a file on a FAT file system (and to a certain extent, NTFS), the contents are still there until you use that sector again or you intentionally wipe it with garbage.

(If you haven't noticed, I really really like forensics, whether it be normal stuff or computer forensics - I've been called in some times to do cleanups after someone has broken into a box or someone is suspected of hiding something)

http://support.microsoft.com/?kbid=909444

SYMPTOMS
On a computer that is running Microsoft XP, Microsoft Windows 2000 Server, or Windows Server 2003, one or more problems may occur after you install the critical update that is discussed in Microsoft Security Bulletin MS05-051. These problems include the following:
• The Windows Installer service may not start.
• The Windows Firewall Service may not start.
• The Network Connections folder is empty.
• The Windows Update Web site may incorrectly recommend that you change the Userdata persistence setting in Microsoft Internet Explorer.
• Active Server Pages (ASP) pages that are running on Microsoft Internet Information Services (IIS) return an “HTTP 500 – Internal Server Error� error message.
• The Microsoft COM+ EventSystem service will not start.
• COM+ applications will not start.
• The computers node in the Microsoft Component Services Microsoft Management Console (MMC) tree will not expand.
• Authenticated users cannot log on, and a blank screen appears after the users apply the October Security Updates.

This seems to be a hard to find utility on Microsoft's site. CopyProfile.exe - does what it says, especially handy for people that setup their laptop with all their preferences and then joined a domain and wanted to keep all their settings the same.

I think your protected stores get invalidated but oh well. You might have to manually import your Outlook Express stores if you still use that program.
I'd use Thunderbird over OE anyway.

http://www.microsoft.com/downloads/details.aspx?FamilyID=ed182a96-f3a6-4fdd-862b-1ae03dc130c1&DisplayLang=en

It's already out on MSDN.

http://www.microsoft.com/presspass/press/2005/oct05/10-14DigitalLifePR.mspx

[snip]

Using the built-in Media Center Extender technology of Xbox 360, planned for availability Nov. 22 in North America, Update Rollup 2 will connect Xbox 360 to a Media Center Edition PC, offering instant access to thousands of on-demand movies, music and videos available on the Media Center PC, and enabling users for the first time ever to stream high-definition content from Media Center PCs. Update Rollup 2 further builds on the Windows XP Media Center Edition 2005 experience by delivering a set of performance improvements and new features that enhance Media Center, including the following:

* DVD changer support. New integrated support for external DVD changers will enable consumers to watch movies and manage up to 200 DVD selections from the Media Center interface. Media Center will display information and cover art for each movie loaded in the DVD changer. Media Center-supported DVD changers will be available beginning this year.

* Away Mode. Away Mode will bring the convenience, quiet performance and instant on/off functionality of consumer electronics to Media Center PCs. Away Mode improves upon current PC power-management systems by enabling the system to silently perform unattended tasks — such as recording TV shows and streaming content to Media Center Extenders — in a low-power mode that makes the PC appear off. Away Mode will be available on select new Media Center PCs in upcoming months from partners Acer Co. Ltd., Fujitsu Siemens Computers, Gateway Inc., HP, Phillips Consumer Electronics, Samsung Electronics Co. Ltd. and Shuttle Inc.

* DVD-burning improvements. Updates to the Sonic Solutions DVD burning engine will improve the performance and capabilities of DVD burning in Media Center Edition. Consumers will be able to convert high-definition TV shows to standard definition and burn to a DVD all in one step, as well as burn to a DVD from other PCs on their home network.

* Additional HDTV tuner support. Update Rollup 2 adds support for one more HDTV tuner, meaning it will support up to four tuners: two analog and two ATSC high definition. U.S. customers will be able to use two NTSC (analog) capture boards and two ATSC (digital) capture boards. This will enable personal video recording of two shows at the same time, broadcast as either ATSC digital TV (480p) or high-definition TV (720p/1080i).

I was looking for specific ICA file options so I went searching for "TWIMode=On" and it pulled up a bunch of publically accessible ICA files that I suspect are not supposed to be google-able. A good .htaccess or IIS permission would fix that up, or to a certain extent, an entry in robots.txt, but, wow. That's just, scary.

One of my latest 'crazy scientist' experiments is giving the new DFS v2 server/client stuff in Windows 2003 R2 a work out over a cell phone datalink. Let me tell ya, it runs a lot better than v1 ever thought of. No longer do you have folders that are replicating partially and then replicating again with an even longer folder name. Today I cleaned up 2 Win2k servers that had decided to have a 'SYSVOL tornado party' with tons of stale and incorrect files. It seems to happen whenever one box gets low on non-paged pool ram. DFS v2 doesn't seem to do this anymore.

Either way... it's a totally sick and wrong test setup, but I love it.

Basically one system sits at a location with a decent amount of bandwidth (T1) and the other sits at home (pseudo-branch office) on a 144kbit (at best) cell phone 1xRTT CDMA connection. If the files are mostly uncompressed, you should see some speed ups due to the compression on the fly that DFS v2 uses.

In theory, and in practice can always be different, but so far, it seems to hold true.

From: http://www.woodtv.com/global/story.asp?s=3976146

[snip]

LANSING, Mich. Got an old Commodore or Atari computer collecting dust at home?
Goodwill now is accepting old computers as part of a new program with computer maker Dell called RECONNECT Michigan.

The program will refurbish and reuse some machines, strip and sell others for parts or completely recycle others.

The free program will be offered at each of the state's 73 Goodwill stores and distribution centers. Organizers are aiming to divert more than three (M) million pounds of old computers and other electronics from landfills over one year.

Goodwill Association of Michigan director Susanne Fredericks said the program comes at a good time for her organization and its donors. Many Goodwill stores in the state had to stop taking electronics because older units weren't selling in stores.

[/snip]

As a side note, if you have a Commodore or Atari computer collecting dust at home, give it to me instead.

http://cband.linux.pl/

Haven't tried it yet but it looks nice, in that it can be per user/virtual host/etc.

MS05-051 exploits are out and about and the bad part is that it affects more systems than the one that caused all the problems a while ago.


http://www.microsoft.com/technet/security/Bulletin/MS05-051.mspx

This is actually good news, security wise. I'm just worried about services that will break.

From the latest Windows Hardware news:

In Microsoft Windows XP, Windows Server 2003, and earlier versions of the Windows operating system, all services run in the same session as the first user who logs on to the console. This session is called Session 0. Running services and user applications together in Session 0 poses a security risk because services run at elevated privilege and therefore are targets for malicious agents looking for a means to elevate their own privilege level.

The Windows Vista operating system mitigates this security risk by isolating services in Session 0 and making Session 0 noninteractive. In Windows Vista, only system processes and services run in Session 0. The first user logs on to Session 1, and subsequent users log on to subsequent sessions. This means that services never run in the same session as users' applications and are therefore protected from attacks that originate in application code.

What might be affected by this change? Possibly:

• Any applications or drivers that are installed as services.

• Any drivers that are loaded within operating system services.

• Any processes running in Session 0 (such as printer drivers or UMDF drivers).
For example, if a device installer running in Session 0 creates a dialog box that requires user input to continue, the device installation never completes because the user does not see the dialog box. From the user's perspective, the device installer appears hung.
Other areas that might be affected include interprocess communication and assumptions about display resolution and the namespace that contains named objects.
What you should do in your drivers?

• Use a client/server mechanism such as remote procedure call (RPC) or named pipes rather than window messages to communicate with applications.

• Implement any user interface using WTSSendMessage or CreateProcessAsUser.

• Query display properties in the user's session, not in Session 0.

• Explicitly choose either the Local\ or Global\ namespace for any named objects.

• Test the driver in Windows Vista to ensure that it runs properly. If that is not possible, test the driver in Windows XP with Fast User Switching enabled and multiple users logged on.

For more details, please read: Impact of Session 0 Isolation on Services and Drivers in Windows Vista

-Annie Pearson
for the WHDC team

User can't send to 'username@yaho.com' and complains, quite a bit..

Well, the problem is pretty obvious to me.. I'll leave the rest of the combinations of 'ya ho' phrases to myself for now.
It amused me quite a bit either way... ya ho.

... if someone pre-made these, I bet they would sell, except there would always be the idiot out there that somehow used it wrong and would accidentally make it an EtherKiller.

http://www.ossmann.com/5-in-1.html

Another note to self - basically you can use MetaEdit to change the default banner for SMTP so that you aren't advertising to the world what version of Exchange/Windows/etc you are running. I know, I know, security thru obscurity isn't really security since anyone worth a lick in hacking e-mail will just look for the XEXCH50 or X-LINK2STATE keywords returned from EHLO.

My main goal is to put "(NO UCE)" in the banner so legit spammers (yeah right) won't spam my hosts.

http://support.microsoft.com/?kbid=555080

There is also a KB for Windows 2000/Exchange 2000 but I don't have it handy at the moment.
Note to self: Put it in later

Thankfully with Exchange 2003 SP2, the limit goes up to 72GB but I still have quite a few customers that don't want to pony up the dough for the Enterprise edition so they play the 16GB info store dance.

I seem to be referencing this more and more so this is mainly a note for myself:

[snip]

Exchange Server Mailbox Store does not mount when the Mailbox Store database reaches the 16-GB limit
http://support.microsoft.com/kb/828070/

[/snip]