Sign In
Eugene Siu's Thoughts on Security
Share my latest security research and techniques
Translate This Page
Translate this page
Powered by
Microsoft® Translator
Options
About
Email Blog Author
RSS for posts
Atom
RSS for comments
OK
Search
Advanced search options...
Search In:
Everything
Blogs
Forums
People
Groups
Places
Pages
Date range:
All Time
Last Year
Last 6 Months
Last 3 Months
Last Month
Last Week
Last Two Days
Tags
<script>alert()</script>
Developer Productivity
Exchange server
IIS
Infoworker Productivity
Mobile Phone
Security
Archive
Archives
November 2008
(2)
October 2008
(3)
March 2008
(1)
November 2007
(1)
October 2007
(8)
September 2007
(6)
May 2007
(2)
April 2007
(1)
March 2007
(1)
February 2007
(3)
January 2007
(2)
July 2005
(1)
March 2005
(2)
February 2005
(1)
January 2005
(2)
December 2004
(1)
November 2004
(3)
MSDN Blogs
>
Eugene Siu's Thoughts on Security
Posts
Subscribe via RSS
Sort by:
Most Recent
|
Most Views
|
Most Comments
Excerpt View
|
Full Post View
Eugene Siu's Thoughts on Security
(In)Security of MultiByteToWideChar and WideCharToMultiByte (Part 2)
Posted
over 4 years ago
by
Eugene Security
1
Comments
Part 1 of this installment discussed the unsafe nature of MultiByteToWideChar and WideCharToMultiByte. They do not guarantee terminating strings properly. In this installment, I want to focus on the count parameters. There are three...
Eugene Siu's Thoughts on Security
(In)Security of MultiByteToWideChar and WideCharToMultiByte (Part 1)
Posted
over 4 years ago
by
Eugene Security
1
Comments
There are a few well-known unsafe APIs in the standard C library, such as strcpy and memcpy. These routines are unsafe as buffer and destination buffer size are not taken into consideration. Buffer overflows may take place because destination...
Eugene Siu's Thoughts on Security
My favorite security blogs and podcasts
Posted
over 4 years ago
by
Eugene Security
1
Comments
What are your favorite security blogs or podcasts? Here are mine. Please leave yours in the comment section. Podcasts Security Now ( http://www.grc.com/securitynow.htm ) CNet Security Bites ( http://securitybites.cnet.com ) Blogs Schneier...
Eugene Siu's Thoughts on Security
“Out of Band” security patch MS08-067
Posted
over 4 years ago
by
Eugene Security
1
Comments
Out of Band security patch MS08-067 is released today. Microsoft strives to keep our monthly patch Tuesday release cycle so that enterprise administrators can plan ahead for their testing and deployment. When out of band is released, it must...
Eugene Siu's Thoughts on Security
What is unique about patch Tuesday of October 2008?
Posted
over 4 years ago
by
Eugene Security
0
Comments
Technorati Tags: Security Every second Tuesday, MSRC releases security patches for Microsoft products that have fixed vulnerabilities. The best is to have no patches for patch Tuesdays, and many administrators can take a break from installing patches...
Eugene Siu's Thoughts on Security
<script>alert()</script>
Posted
over 4 years ago
by
Eugene Security
1
Comments
<script>alert()</script>
Eugene Siu's Thoughts on Security
Troubleshooting Networking and IPSec Issues
Posted
over 5 years ago
by
Eugene Security
1
Comments
I had a very strange networking issue last weekend. After connecting to corpnet via VPN and direct hookup, I was able to ping all remote servers, but was not able to do anything, such as web browsing and remote desktop. It was not the first time that...
Eugene Siu's Thoughts on Security
ASP.NET ValidateRequest does not mitigate XSS completely
Posted
over 5 years ago
by
Eugene Security
5
Comments
As a security guy, I can safely say that there is no magic bullet to mitigate any security problems completely, and cross-site scripting(XSS) bugs are not exceptions. Since ASP.NET 1.1, ValidateRequest can be configured in web.config to check and reject...
Eugene Siu's Thoughts on Security
Read Office Files as ZIP
Posted
over 5 years ago
by
Eugene Security
1
Comments
It is interesting to me that Office 2007 Metro formats can be broken down as a ZIP file. To see this in action, you can pick an Office 2007 Metro file, such as XLSX and DOCX, and rename its extension with ZIP. Then open the renamed file with WINZIP. You...
Eugene Siu's Thoughts on Security
Is Microsoft Office Isolated Conversion Environment(MOICE) mocha on ice?
Posted
over 5 years ago
by
Eugene Security
2
Comments
MOICE may sound like mocha on ice, but it is really a strong dark espresso shot offered by Office TWC team to jolt up security. Microsoft Office Isolated Conversion Environment (MOICE) is a new security tool that helps protect Office users from malicious...
Eugene Siu's Thoughts on Security
True test of a security geek
Posted
over 5 years ago
by
Eugene Security
2
Comments
If you chuckle at this comic strip, congratulations! You are a security geek. If you don't chuckle, it is never too late to become one. Read my blog more, and you will become one. Thanks TechJunkie for forwarding.
Eugene Siu's Thoughts on Security
Given enough eyeballs all bugs are shallow: True or False?
Posted
over 5 years ago
by
Eugene Security
2
Comments
"Given enough eyeballs all bugs are shallow." I do agree if more right-minded folks look at a piece of code, it would help identify both security and non-security bugs. This premise is built on the assumption that all reviewers have the best intentions...
Eugene Siu's Thoughts on Security
System.URI.AbsolutePath Vs Phishing Attack
Posted
over 5 years ago
by
Eugene Security
2
Comments
Phishing attack can be caused by users inadvertently clicking on malicious links in emails or web pages, which then forward requests to malicious websites. A common phishing technique is to fake emails sent by well-known banks or merchants,, which contain...
Eugene Siu's Thoughts on Security
Web Service Security Guidance
Posted
over 5 years ago
by
Eugene Security
3
Comments
I have just published a Technet article. This is geared for administrators and developers as an introduction to web service security. It contains lots of references that allow you to deepend your knowledge of web service security. Please visit http:/...
Eugene Siu's Thoughts on Security
More eyeballs for .Net Framework code
Posted
over 5 years ago
by
Eugene Security
2
Comments
Microsoft will open up source code of .Net Framework to the public. It allows outsiders to review what is under the hood, and enables easier debugging of development projects around .Net Framework. .Net Framework code has been reviewed heavily, and developers...
Eugene Siu's Thoughts on Security
Anti-Malware and Spyware help for home users
Posted
over 5 years ago
by
Eugene Security
1
Comments
Working for Microsoft means that I become de facto technical support for my friends and family. That should be the experiences of many folks in the computer industry. When I introduce my job title as "senior security consultant" to friends and family...
Eugene Siu's Thoughts on Security
HTTP Header Injection Vulnerabilities
Posted
over 5 years ago
by
Eugene Security
1
Comments
HTTP Response Splitting was discovered several years ago. It allows attackers to split a HTTP response into multiple ones by injecting malicious response HTTP headers. This attack can deface web sites, poison cache and trigger cross-site scripting. Rather...
Eugene Siu's Thoughts on Security
Reset Outlook connections without restart
Posted
over 5 years ago
by
Eugene Security
1
Comments
This is a well hidden trick in Outlook. Not sure why this needs to be hidden. You can open Connection Status window by holding CTRL + right-clicking on the Outlook system tray icon on the Task Bar. I want to highlight a couple features: * Reset all connections...
Eugene Siu's Thoughts on Security
Silverlight security MSDN magazine article
Posted
over 5 years ago
by
Eugene Security
1
Comments
I have submitted an article proposal to MSDN to write about Silverlight security with my buddy in Silverlight team. If this proposal gets accepted, you will see the article on MSDN magazine soon. Abstract: Silverlight is the latest cross-browser and cross...
Eugene Siu's Thoughts on Security
Just learned how to cross-post via MetaWeblog API
Posted
over 5 years ago
by
Eugene Security
0
Comments
I work for ACE team, and want to cross-post from http://blogs.msdn.com/esiu to http://blogs.msdn.com/ace_team . Community Server supports MetaWeblog API, but I am not able to figure out how to configure cross-posting. After a few tries, I am able to cross...
Eugene Siu's Thoughts on Security
IE Developer Toolbar helps me hack
Posted
over 5 years ago
by
Eugene Security
1
Comments
I was browsing IE blog articles to get research ideas. I came across IE Developer Toolbar , and decided to play with it. I was checking out different options, and it impressed me as a good web client developer tool, as it offers a breakdown of HTML elements...
Eugene Siu's Thoughts on Security
Exchange 2007 RPC interfaces are locked down
Posted
over 5 years ago
by
Eugene Security
1
Comments
Exchange 2007 RPC interfaces have retired support of various legacy RPC bindings, including AppleTalk, SPX and Banyan Vines. This exemplifies the philosophy of reducing attack surface area in the design of Exchange 2007.
Eugene Siu's Thoughts on Security
My first passphrase
Posted
over 5 years ago
by
Eugene Security
1
Comments
I have read many articles about the benefits of using passphrases in contrast to passwords. For more details, you can read http://blogs.technet.com/robert_hensing/archive/2004/07/28/199610.aspx . I have always been convinced about the use of passphrases...
Eugene Siu's Thoughts on Security
Distribution List is more locked down in Exchange 2007 to reduce spam
Posted
over 5 years ago
by
Eugene Security
1
Comments
Distribution list is used for grouping users together, and emails can be sent to all members belonging to a DL. In Exchange 2003, the default setting is that a DL accepts emails from any email addresses. It can be configured to reject external email addresses...
Eugene Siu's Thoughts on Security
Thou shall tune your Blackjack
Posted
over 5 years ago
by
Eugene Security
0
Comments
Default Blackjack settings from Cingular have the following problems: Battery life is short because frequent sync drains too much battery Dropped calls happen often due to network transition from 3G to Edge In order to make your new Blackjack...
Page 1 of 2 (40 items)
1
2